6 ms·
Technically, yes, you're right. But in practice, the higher the visibility of the code you're relying on, the more likely it is that other people have caught s
by fwdpropaganda 9y ago
Technically, yes, you're right.
But in practice, the higher the visibility of the code you're relying on, the more likely it is that other people have caught something fishy. And POST is higher visibility than lockbox. This is also the reason why even though I trust Mozilla very much, I don't use Sync. It's lower visibility than the vanilla stuff.
Also, attack surface.
- daveFNbuck 9y agoThat's a much more nuanced point than "don't trust anyone with your passwords." I agree with your reasoning, but that doesn't mean you shouldn't ever trust a password manager. It just means that you should have a high standard for when you should trust one. Not having a password manager opens up attack surfaces as well. Having a password manager integrated into my browser has prevented me from typing my password into a lookalike site from a different domain. It also means I don't use the same password for any two sites, and the password I use for each site is much stronger than it would otherwise be. There's the potential for the password manager to get compromised, but the benefits seem to outweigh that for now.