9 ms·

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

by martin1975 10y ago

mcbutterbunz 10y ago
I would suggest not using the auto fill feature of password managers. I use 1Password and the mini UI that sits in the tray is super easy to copy a password from and paste in the browser.
- tcbawo 10y ago
  Why not use auto fill? I consider that a decent defense against phishing attempts. Now I always think twice before entering my name and password.
  - russell_h 10y ago
    Autofill requires a browser extension. There are at least three major risks associated with this: 1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passphrase. Other extensions may be able to emulate this behavior or otherwise intercept your passphrase. Anyone who isn't using a password manager should do so. A password manager with autofill is a huge step forward from nothing. But disabling autofill offers some further benefit.
    - chrisper 10y ago
      I don't think this is true. Keepass can do autofill without a browser extension. Or are we talking about a different feature?
      - Semaphor 10y ago
        Keepass can't? It can fill upon request with Ctrl+V which does <username>[TAB]<password>[Enter], but to automatically fill passwords you need the http plugin for keepass and a browser extension.
    - extra88 10y ago
      1Password does not have a list of "secrets" that it draws from for all forms, it only saves the information you provide per-site; anything it submits to a site is information you've already submitted to the site previously. 1Password's extension does not prompt for my master passphrase, I have to click on it to enter it (if I haven't already). It also to don't try to fill forms on page load, I have to instruct it to do so. By default it will usually submit a form upon fill but I often turn off that setting. As for browser vulnerabilities, I'm not familiar with any information about extensions being particularly vulnerable to browser exploits, it seems like when browsers get "pwned," anything in userland (if not the whole system) is up for grabs so avoiding the password manager's browser extension doesn't gain you anything. I'm not saying there's no risk, just that trade-off is worth it. Agilebits argues that using the extension is safer because it avoids keystroke loggers and clipboard sniffers [0] [0] https://blog.agilebits.com/2014/08/21/watch-what-you-type-1passwords-defenses-against-keystroke-loggers/ https://blog.agilebits.com/2014/08/21/watch-what-you-type-1p...
      - tcbawo 10y ago
        I use LastPass, and features you mentioned also apply. LastPass also unfortunately has in-pane banner pop-ups which I do not trust at all. Blind and automatic autofill is dangerous. I'm not sure if you can enable that. Another feature I like is the detection of compromised sites and password rotation reminders.
  - DaniloDias 10y ago
    Select view source on a page where credentials are auto populated. See your password. Now imagine you stepped away from your machine while still logged in. Autofill is convenient, but there are negative consequences.
sciyoshi 10y ago
Have you tried Dashlane? I've been using it for over a year and it's been great. Their mobile app is really handy as well.
newman314 10y ago
1Password
koko775 10y ago
Seconding 1Password. It also works on Firefox and can be used from Mobile Safari and apps that implement support specifically for it, if you have an iPhone.
donatj 10y ago
The killer android support is why I still use it. Auto fill in any app.
- chrisper 10y ago
  You can do that with keepass2android as well.
JelteF 10y ago
Keepass, although to be fair I don't think all the plugins on this page have been properly reviewed: http://keepass.info/plugins.html http://keepass.info/plugins.html
AhtiK 10y ago
Has anyone used hardware-based password manager like Trezor Password Manager? [1] [2] Initially Trezor was created as a bitcoin wallet but is much more these days. The issue with 1Password is that it's not accessible in Linux and no U2F (yubikey etc) support AFAIK... [1] https://trezor.io/passwords/ https://trezor.io/passwords/ [2] https://blog.trezor.io/satoshilabs-launches-trezor-password-manager-the-ultimately-secure-no-master-password-cloud-1b260e5fbe6b#.gjgqeattk https://blog.trezor.io/satoshilabs-launches-trezor-password-...
- RubyPinch 10y ago
  I've wanted to use such a thing, but the requirement to use a specific browser is always a massive bother same with things like yubikey It seems like it would be better to just fake a keyboard output instead? then you could have something that could work on all platforms in all situations
  - freeone3000 10y ago
    KeePass does this. Autofill activates the last window, finds the "input control" on the window, then tries to type in the username, tab key, password. It breaks in all the expected ways, and sometimes new and exciting ways.
    - RubyPinch 10y ago
      That is software emulation though, which is restricted by various things (can't type across users (so breaks on Run As, and elevated windows), if a window implements a custom control, it won't work with that either since that window likely reads from the keyboard in a weird or wonderful way, some windows also just avoid any windows messaging and read the keyboard directly) Hardware faking of the keyboard would work fine though
- manyxcxi 10y ago
  If you install 1Password 4 in Wine it works pretty well, I've even got browser extensions working with my Linux browser. Its not great and it crashes some, but it does work.
runejuhl 10y ago
I use pass ( http://passwordstore.org/ http://passwordstore.org/ ). Uses gpg, has addons for all major browsers, works on Android, is completely transparent, supports segmenting your password "tree" to use different PGP keys depending on path (e.g. all passwords in www/ encrypted to both my safe GPG key and my less safe key unique to my phone). Highly recommended.
- mihaifm 10y ago
  any iOS app for it?
  - chrishawes 10y ago
    There are a couple: https://github.com/davidjb/pass-ios https://github.com/davidjb/pass-ios https://github.com/mssun/passforios https://github.com/mssun/passforios Passforios is being actively developed and is shaping up well.
manyxcxi 10y ago
1Password, and it's been awesome. If you use the non-hosted version you control the whole thing. LAN only sync, or Dropbox, Rsync, however you want to sync it if it matters. Otherwise they've got a hosted version which can also give you web access in a pinch and handle all the syncing for you. I have been with them for long enough that my only option was a non-hosted version and I keep in sync with Dropbox and it works wonderfully. The Mac client is very nice to use. The Windows client works well but isn't as nice looking. The browser extension is awesome- AND you can put MFA keys in there as well. EDIT: And I forgot to mention the main reason I chose 1Password so long ago. Their iOS app is awesome and their mobile Safari integration works quite well.
- kevinoconnor7 10y ago
  But no linux support.
  - manyxcxi 10y ago
    No direct Linux support but you can absolutely run the windows version 4 in Wine. It's not without a few crashy glitches but for just using stored passwords it works fine. It would be very nice if they did support Linux and people have been asking for it, but there is a passable workaround- and frankly one I'm willing to work with because it works so great everywhere else.
    - kevinoconnor7 10y ago
      That only works if you store your vault yourself. When I tried it out I wanted 1password family so I could share some accounts with my partner. 1password 4 doesn't support their cloud datastore; the version that does will not run on Wine. However, I could use the webapp on linux. It was a bit annoying but I could have dealt with it. The other complaint I had was the UX for Android. Having to switch my keyboard every time I wanted to enter a password was very annoying. Hopefully that gets better with the recently announced Autofill API for Android O.
JonathonCwik 10y ago
I use password safe: https://pwsafe.org/ https://pwsafe.org/ with a strong central password and store the safe it in my Dropbox. Even if my cloud was compromised, the safe is highly encrypted. PasswordSafe's safe is an open source file structure and thus there are many different ways to access it with different features for each. I have PasswordSafe on both my Windows PC and android phone and I'm using PasswordSafe professionally for my organization's passwords and found that there are reliable Mac options so those with Macs can access the safe.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

I would suggest not using the auto fill feature of password managers. I use 1Password and the mini UI that sits in the tray is super easy to copy a password from and paste in the browser.

tcbawo 10y ago
Why not use auto fill? I consider that a decent defense against phishing attempts. Now I always think twice before entering my name and password.
- russell_h 10y ago
  Autofill requires a browser extension. There are at least three major risks associated with this: 1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passphrase. Other extensions may be able to emulate this behavior or otherwise intercept your passphrase. Anyone who isn't using a password manager should do so. A password manager with autofill is a huge step forward from nothing. But disabling autofill offers some further benefit.
  - chrisper 10y ago
    I don't think this is true. Keepass can do autofill without a browser extension. Or are we talking about a different feature?
    - Semaphor 10y ago
      Keepass can't? It can fill upon request with Ctrl+V which does <username>[TAB]<password>[Enter], but to automatically fill passwords you need the http plugin for keepass and a browser extension.
  - extra88 10y ago
    1Password does not have a list of "secrets" that it draws from for all forms, it only saves the information you provide per-site; anything it submits to a site is information you've already submitted to the site previously. 1Password's extension does not prompt for my master passphrase, I have to click on it to enter it (if I haven't already). It also to don't try to fill forms on page load, I have to instruct it to do so. By default it will usually submit a form upon fill but I often turn off that setting. As for browser vulnerabilities, I'm not familiar with any information about extensions being particularly vulnerable to browser exploits, it seems like when browsers get "pwned," anything in userland (if not the whole system) is up for grabs so avoiding the password manager's browser extension doesn't gain you anything. I'm not saying there's no risk, just that trade-off is worth it. Agilebits argues that using the extension is safer because it avoids keystroke loggers and clipboard sniffers [0] [0] https://blog.agilebits.com/2014/08/21/watch-what-you-type-1passwords-defenses-against-keystroke-loggers/ https://blog.agilebits.com/2014/08/21/watch-what-you-type-1p...
    - tcbawo 10y ago
      I use LastPass, and features you mentioned also apply. LastPass also unfortunately has in-pane banner pop-ups which I do not trust at all. Blind and automatic autofill is dangerous. I'm not sure if you can enable that. Another feature I like is the detection of compromised sites and password rotation reminders.
- DaniloDias 10y ago
  Select view source on a page where credentials are auto populated. See your password. Now imagine you stepped away from your machine while still logged in. Autofill is convenient, but there are negative consequences.

sciyoshi 10y ago

Have you tried Dashlane? I've been using it for over a year and it's been great. Their mobile app is really handy as well.

newman314 10y ago

1Password

koko775 10y ago

Seconding 1Password. It also works on Firefox and can be used from Mobile Safari and apps that implement support specifically for it, if you have an iPhone.

donatj 10y ago

The killer android support is why I still use it. Auto fill in any app.

chrisper 10y ago
You can do that with keepass2android as well.

JelteF 10y ago

Keepass, although to be fair I don't think all the plugins on this page have been properly reviewed: http://keepass.info/plugins.html http://keepass.info/plugins.html

AhtiK 10y ago

Has anyone used hardware-based password manager like Trezor Password Manager? [1] [2] Initially Trezor was created as a bitcoin wallet but is much more these days. The issue with 1Password is that it's not accessible in Linux and no U2F (yubikey etc) support AFAIK... [1] https://trezor.io/passwords/ https://trezor.io/passwords/ [2] https://blog.trezor.io/satoshilabs-launches-trezor-password-manager-the-ultimately-secure-no-master-password-cloud-1b260e5fbe6b#.gjgqeattk https://blog.trezor.io/satoshilabs-launches-trezor-password-...

RubyPinch 10y ago
I've wanted to use such a thing, but the requirement to use a specific browser is always a massive bother same with things like yubikey It seems like it would be better to just fake a keyboard output instead? then you could have something that could work on all platforms in all situations
- freeone3000 10y ago
  KeePass does this. Autofill activates the last window, finds the "input control" on the window, then tries to type in the username, tab key, password. It breaks in all the expected ways, and sometimes new and exciting ways.
  - RubyPinch 10y ago
    That is software emulation though, which is restricted by various things (can't type across users (so breaks on Run As, and elevated windows), if a window implements a custom control, it won't work with that either since that window likely reads from the keyboard in a weird or wonderful way, some windows also just avoid any windows messaging and read the keyboard directly) Hardware faking of the keyboard would work fine though
manyxcxi 10y ago
If you install 1Password 4 in Wine it works pretty well, I've even got browser extensions working with my Linux browser. Its not great and it crashes some, but it does work.

runejuhl 10y ago

I use pass ( http://passwordstore.org/ http://passwordstore.org/ ). Uses gpg, has addons for all major browsers, works on Android, is completely transparent, supports segmenting your password "tree" to use different PGP keys depending on path (e.g. all passwords in www/ encrypted to both my safe GPG key and my less safe key unique to my phone). Highly recommended.

mihaifm 10y ago
any iOS app for it?
- chrishawes 10y ago
  There are a couple: https://github.com/davidjb/pass-ios https://github.com/davidjb/pass-ios https://github.com/mssun/passforios https://github.com/mssun/passforios Passforios is being actively developed and is shaping up well.

manyxcxi 10y ago

1Password, and it's been awesome. If you use the non-hosted version you control the whole thing. LAN only sync, or Dropbox, Rsync, however you want to sync it if it matters. Otherwise they've got a hosted version which can also give you web access in a pinch and handle all the syncing for you. I have been with them for long enough that my only option was a non-hosted version and I keep in sync with Dropbox and it works wonderfully. The Mac client is very nice to use. The Windows client works well but isn't as nice looking. The browser extension is awesome- AND you can put MFA keys in there as well. EDIT: And I forgot to mention the main reason I chose 1Password so long ago. Their iOS app is awesome and their mobile Safari integration works quite well.

kevinoconnor7 10y ago
But no linux support.
- manyxcxi 10y ago
  No direct Linux support but you can absolutely run the windows version 4 in Wine. It's not without a few crashy glitches but for just using stored passwords it works fine. It would be very nice if they did support Linux and people have been asking for it, but there is a passable workaround- and frankly one I'm willing to work with because it works so great everywhere else.
  - kevinoconnor7 10y ago
    That only works if you store your vault yourself. When I tried it out I wanted 1password family so I could share some accounts with my partner. 1password 4 doesn't support their cloud datastore; the version that does will not run on Wine. However, I could use the webapp on linux. It was a bit annoying but I could have dealt with it. The other complaint I had was the UX for Android. Having to switch my keyboard every time I wanted to enter a password was very annoying. Hopefully that gets better with the recently announced Autofill API for Android O.

JonathonCwik 10y ago

I use password safe: https://pwsafe.org/ https://pwsafe.org/ with a strong central password and store the safe it in my Dropbox. Even if my cloud was compromised, the safe is highly encrypted. PasswordSafe's safe is an open source file structure and thus there are many different ways to access it with different features for each. I have PasswordSafe on both my Windows PC and android phone and I'm using PasswordSafe professionally for my organization's passwords and found that there are reliable Mac options so those with Macs can access the safe.