3 ms·
The article completely misses the threat model, or the comparison on the threat models. FOR REGULAR USERS, the choice is to either have an easy to remember/gues
by orev 9y ago
The article completely misses the threat model, or the comparison on the threat models. FOR REGULAR USERS, the choice is to either have an easy to remember/guess/same password on every Internet-exposed site, OR to use the password saver with a potentially easy to guess local password while using longer/harder/different passwords on each site. The second model is far stronger than the first, as one now has at least some protection from the enitre Internet and unscrupulous web site operators. A local compromise is bad of course, but that affects both models equally as either the password database is stolen, a keylogger is installed, or any of the number of other issues that arise from gaining local access to a system.
- palant 9y agoNo, I didn't miss the threat model. I am all for password managers, in fact I am even developing one myself. The sad truth is however, most password managers aren't exactly a shining example of security best practices. This blog post is simply me being disappointed seeing Mozilla do so poorly. As things are now, the master password on the Firefox password manager (a common recommendation meant to improve security) is little more than security theater. But I'm not saying of course that no password manager whatsoever is a better solution.