3 ms·

This is what's holding me back from changing mostly. Honestly, lastpass is great for me but I almost wish built in browser password managers were better. I used

This is what's holding me back from changing mostly. Honestly, lastpass is great for me but I almost wish built in browser password managers were better. I used to use Google Chrome's password manager but one time I synced with another computer or phone and everything got erased and there was no undoing it. I lost everything. Maybe syncing is better now but after that sync that thought "hey let's make sure everything is like this brand new device" I hesitate.

sleepychu 9y ago
I think the main problem with the inbuilt password managers is they're designed as a convenience mechanism to locally store password copies, not as a complete replacement for user remembered passwords.
Santosh83 9y ago
High time that passwords management was integrated into the OS, where it belongs. These days its not just sites, but hundreds of apps too that want your passwords, and browser based extensions can't interface with other apps. On the other hand a standalone password manager has at best a flaky interaction with web pages inside a browser window, and often has to be supported by an in-broswer extension, adding to complexity of code and interaction. We need the OS to store credentials and expose a well-defined, OS independent API for apps/sites to identify themselves securely and request for the user's authentication. This will go a long way towards mitigating exploits like cross-site scripting attacks, phishing, software keyloggers, clipboard sniffers and so on. I really find it amazing that this is something none of the major OS creators have tackled in a standarised manner.
- Shorel 9y ago
  I really doubt a Microsoft Windows integrated password manager could be conveniently accessed from Android, OSX or Ubuntu. In fact, I imagine almost every OS vendor would try some form of lock-in.
  - drdaeman 9y ago
    An application can read from one store and send data to another app to persist into another store. The one issue I see is that to sync properly such app would need a changelist (with the vector clocks and stuff), and the only thing most credential stores provide is the current state and no history track. An app may implement such list to itself, though, outside of the OS credential storage - without actual credentials, just referring to the record IDs so it's not too sensitive. Another is, such external app would need to repeatedly access the credential store. If there is no API to detect if the store is locked or not, it may either require to keep it unlocked, or spam user with access prompts or something like that. Oh, and it would be problematic if the store pins records to the applications and doesn't allow e.g. Chrome to access Firefox passwords and vice versa. You'll need highly privileged access (root) or somehow hook another app and inject yourself into its address space (WinHook, Xposed, etc). But e.g. Windows Vault <-> KDE or Gnome keyring sync is certainly possible. In theory. Don't know if anyone had ever implemented it in practice, though.
- wpietri 9y ago
  I use multiple OSes on a daily basis. I think most people do. The right time for OSes to solve this problem was circa 2000. After the mainstreaming of the smartphone in 2007, it was too late.

sleepychu 9y ago

I think the main problem with the inbuilt password managers is they're designed as a convenience mechanism to locally store password copies, not as a complete replacement for user remembered passwords.

Santosh83 9y ago

High time that passwords management was integrated into the OS, where it belongs. These days its not just sites, but hundreds of apps too that want your passwords, and browser based extensions can't interface with other apps. On the other hand a standalone password manager has at best a flaky interaction with web pages inside a browser window, and often has to be supported by an in-broswer extension, adding to complexity of code and interaction. We need the OS to store credentials and expose a well-defined, OS independent API for apps/sites to identify themselves securely and request for the user's authentication. This will go a long way towards mitigating exploits like cross-site scripting attacks, phishing, software keyloggers, clipboard sniffers and so on. I really find it amazing that this is something none of the major OS creators have tackled in a standarised manner.

Shorel 9y ago
I really doubt a Microsoft Windows integrated password manager could be conveniently accessed from Android, OSX or Ubuntu. In fact, I imagine almost every OS vendor would try some form of lock-in.
- drdaeman 9y ago
  An application can read from one store and send data to another app to persist into another store. The one issue I see is that to sync properly such app would need a changelist (with the vector clocks and stuff), and the only thing most credential stores provide is the current state and no history track. An app may implement such list to itself, though, outside of the OS credential storage - without actual credentials, just referring to the record IDs so it's not too sensitive. Another is, such external app would need to repeatedly access the credential store. If there is no API to detect if the store is locked or not, it may either require to keep it unlocked, or spam user with access prompts or something like that. Oh, and it would be problematic if the store pins records to the applications and doesn't allow e.g. Chrome to access Firefox passwords and vice versa. You'll need highly privileged access (root) or somehow hook another app and inject yourself into its address space (WinHook, Xposed, etc). But e.g. Windows Vault <-> KDE or Gnome keyring sync is certainly possible. In theory. Don't know if anyone had ever implemented it in practice, though.
wpietri 9y ago
I use multiple OSes on a daily basis. I think most people do. The right time for OSes to solve this problem was circa 2000. After the mainstreaming of the smartphone in 2007, it was too late.