5 ms·

The author admitted the stronger-than-needed title in the first comment, but I'd like to make it clear when talking about practical personal security: There ar

The author admitted the stronger-than-needed title in the first comment, but I'd like to make it clear when talking about practical personal security: There are ~100,000 people in the world that would think to run a GPU password cracker on your Firefox master password hash, if they had access and wanted to snoop. There are ~1,000,000,000 people that would think to open your browser and go to a website you use to try to gain access to it. In some sense, although it's hard to quantify security, using a master password is 10,000x more effective than not.

pzxc 9y ago
The alternative is not to give up on password management completely, but to use a proper password manager like KeePass.
- unsignedint 9y ago
  I agree with you on this one, KeePass is way to go compared to relying on browser's password manager. Only wish these password management functionalities (not tool itself, but whole mess switching back and forth between target app/password manager) are more pleasing than the way it is now on mobile...
  - cdancette 9y ago
    Android 8 provides an autofill API for this purpose! But it's only working in apps, not in the browser
- zitterbewegung 9y ago
  What if you took Firefox or chrome and replaced the password manager with a keepass compatible system by default and kept the usability?
  - fyfy18 9y ago
    If password managers are going to become popular for end users it needs to be something that’s built into the browser and interopable. I’d love to see this turned into a standard that all browser and device manufacturers (when I log into an app on my phone the password manager should be integrated) can implement.
  - ailox 9y ago
    As long as there is no default support for keepass, maybe kee/keefox will fit the bill? https://addons.mozilla.org/de/firefox/addon/keefox/ https://addons.mozilla.org/de/firefox/addon/keefox/
- palant 9y ago
  I am all for using a better password manager. In fact, with PfP: Pain-free Passwords I developed one myself - and I invested much thought into making sure the master password cannot realistically be guessed unless it is absolutely trivial. However, most people will go with whatever is built in. So no excuses for browser makers to offer something that has been known to be very suboptimal for at least nine years.
palant 9y ago
Well, the software to crack Firefox master passwords is there for anybody to download. Maybe not quite as well optimized as hashcat with a GPU but it's easy enough to use that plenty of people might decide to try it out.

pzxc 9y ago

The alternative is not to give up on password management completely, but to use a proper password manager like KeePass.

unsignedint 9y ago
I agree with you on this one, KeePass is way to go compared to relying on browser's password manager. Only wish these password management functionalities (not tool itself, but whole mess switching back and forth between target app/password manager) are more pleasing than the way it is now on mobile...
- cdancette 9y ago
  Android 8 provides an autofill API for this purpose! But it's only working in apps, not in the browser
zitterbewegung 9y ago
What if you took Firefox or chrome and replaced the password manager with a keepass compatible system by default and kept the usability?
- fyfy18 9y ago
  If password managers are going to become popular for end users it needs to be something that’s built into the browser and interopable. I’d love to see this turned into a standard that all browser and device manufacturers (when I log into an app on my phone the password manager should be integrated) can implement.
- ailox 9y ago
  As long as there is no default support for keepass, maybe kee/keefox will fit the bill? https://addons.mozilla.org/de/firefox/addon/keefox/ https://addons.mozilla.org/de/firefox/addon/keefox/
palant 9y ago
I am all for using a better password manager. In fact, with PfP: Pain-free Passwords I developed one myself - and I invested much thought into making sure the master password cannot realistically be guessed unless it is absolutely trivial. However, most people will go with whatever is built in. So no excuses for browser makers to offer something that has been known to be very suboptimal for at least nine years.

palant 9y ago

Well, the software to crack Firefox master passwords is there for anybody to download. Maybe not quite as well optimized as hashcat with a GPU but it's easy enough to use that plenty of people might decide to try it out.