4 ms·

Autofill requires a browser extension. There are at least three major risks associated with this: 1. Giving code running in your browser access to your passwor

Autofill requires a browser extension. There are at least three major risks associated with this: 1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passphrase. Other extensions may be able to emulate this behavior or otherwise intercept your passphrase. Anyone who isn't using a password manager should do so. A password manager with autofill is a huge step forward from nothing. But disabling autofill offers some further benefit.

chrisper 10y ago
I don't think this is true. Keepass can do autofill without a browser extension. Or are we talking about a different feature?
- Semaphor 10y ago
  Keepass can't? It can fill upon request with Ctrl+V which does <username>[TAB]<password>[Enter], but to automatically fill passwords you need the http plugin for keepass and a browser extension.
extra88 10y ago
1Password does not have a list of "secrets" that it draws from for all forms, it only saves the information you provide per-site; anything it submits to a site is information you've already submitted to the site previously. 1Password's extension does not prompt for my master passphrase, I have to click on it to enter it (if I haven't already). It also to don't try to fill forms on page load, I have to instruct it to do so. By default it will usually submit a form upon fill but I often turn off that setting. As for browser vulnerabilities, I'm not familiar with any information about extensions being particularly vulnerable to browser exploits, it seems like when browsers get "pwned," anything in userland (if not the whole system) is up for grabs so avoiding the password manager's browser extension doesn't gain you anything. I'm not saying there's no risk, just that trade-off is worth it. Agilebits argues that using the extension is safer because it avoids keystroke loggers and clipboard sniffers [0] [0] https://blog.agilebits.com/2014/08/21/watch-what-you-type-1passwords-defenses-against-keystroke-loggers/ https://blog.agilebits.com/2014/08/21/watch-what-you-type-1p...
- tcbawo 10y ago
  I use LastPass, and features you mentioned also apply. LastPass also unfortunately has in-pane banner pop-ups which I do not trust at all. Blind and automatic autofill is dangerous. I'm not sure if you can enable that. Another feature I like is the detection of compromised sites and password rotation reminders.

chrisper 10y ago

I don't think this is true. Keepass can do autofill without a browser extension. Or are we talking about a different feature?

Semaphor 10y ago
Keepass can't? It can fill upon request with Ctrl+V which does <username>[TAB]<password>[Enter], but to automatically fill passwords you need the http plugin for keepass and a browser extension.

extra88 10y ago

1Password does not have a list of "secrets" that it draws from for all forms, it only saves the information you provide per-site; anything it submits to a site is information you've already submitted to the site previously. 1Password's extension does not prompt for my master passphrase, I have to click on it to enter it (if I haven't already). It also to don't try to fill forms on page load, I have to instruct it to do so. By default it will usually submit a form upon fill but I often turn off that setting. As for browser vulnerabilities, I'm not familiar with any information about extensions being particularly vulnerable to browser exploits, it seems like when browsers get "pwned," anything in userland (if not the whole system) is up for grabs so avoiding the password manager's browser extension doesn't gain you anything. I'm not saying there's no risk, just that trade-off is worth it. Agilebits argues that using the extension is safer because it avoids keystroke loggers and clipboard sniffers [0] [0] https://blog.agilebits.com/2014/08/21/watch-what-you-type-1passwords-defenses-against-keystroke-loggers/ https://blog.agilebits.com/2014/08/21/watch-what-you-type-1p...

tcbawo 10y ago
I use LastPass, and features you mentioned also apply. LastPass also unfortunately has in-pane banner pop-ups which I do not trust at all. Blind and automatic autofill is dangerous. I'm not sure if you can enable that. Another feature I like is the detection of compromised sites and password rotation reminders.