6 ms·

This. I am using LastPass for example, because it is probably only password manager, where you can completely disable auto-fill (you need to click on an input f

This. I am using LastPass for example, because it is probably only password manager, where you can completely disable auto-fill (you need to click on an input field and then pick a profile - so it is "on demand" fill) which makes automatic harvesting attacks much harder. I have switched from 1Password exactly for that reason - 1Password is very aggressive in filling input fields for you.

Cynddl 8y ago
Bitwarden has auto-fill disabled by default, and only enables it with a warning (“Use at your own risk”).
- BartBoch 8y ago
  Good to know, the more alternatives the better.
jplatte 8y ago
The KeePassXC browser integration also does it the way you describe where you choose a profile instead of having the firm already filled in when the page loads.
joshvm 8y ago
Is this new behaviour? In the version of 1Password I have (6.8.8, Mac) it detects the website, but I have to click on the specific login using 1Password Mini to fill the fields. It's never done it automatically as far as I can tell. It tends to be browsers which are gung-ho about automatically filling in login details.
- BartBoch 8y ago
  Nope, I have used 1Password most of last year, maybe they changed it after the data harvesting attack from a few months ago, but for me, the tool was very aggressive in submitting data without me interacting with the website. At the time LastPass was the only major player with "click to launch" feature.
  - have_faith 8y ago
    > data harvesting attack Think I missed that, what happened? I don't enable 1Password autofill or any of it's browser extensions, I just see it as additional attack vectors waiting to be compromised.
    - BartBoch 8y ago
      https://www.howtogeek.com/338209/you-should-turn-off-autofill-in-your-password-manager/ https://www.howtogeek.com/338209/you-should-turn-off-autofil...
      - BonesJustice 8y ago
        From your link: > 1Password isn’t affected by this problem because it doesn’t include an automatic autofill feature. Are you sure we’re talking about the same app? I’ve used 1Password for years, and it’s never autofilled for me. Maybe it was actually your browser’s built-in keyring?
        notheguyouthink 8y ago
        I think they're confusing the 1Password browser extension. 1Password has a native app, which I use on both windows and osx, and I just don't install their browser extension for autofill features. Though, given that I avoid autofill like the plague, I could easily be misunderstanding the issue too. I'm speaking of a subject I don't use, I don't think anyone should haha.
        rootusrootus 8y ago
        I use the browser extension. It does not autofill. I have to open the extension and then select the site before it will fill any form fields.
      - BartBoch 8y ago
        Sorry, I completely screwed here. I think I am way overworked. It's Dashlane that I was using, not 1Password. After Dashlane I was using 1Password for a week but it was not for me, moved to Padlock and now with LastPass. I have migrated to 1Pass and then from it to LastPass, thus the confusion. I checked the history of my backups and somehow forgot about my migration from Dashlane that was the initial tool that would do autofills. Sorry for the confusion, I've should check that more thoroughly. A good sign for me it is time for a walk.
dzhiurgis 8y ago
LastPass have a horrible security track record. I’ve even caught them editing their wiki page, trying to erase their past, which was reverted thanks to HN.
- BartBoch 8y ago
  Yeah, by no means I am an ambassador of them. For me, it was so-so vs bad really.
- izietto 8y ago
  Not-so-happy LastPass user here: I evaluated alternatives, but LastPass is the only one which somehow works on Linux/Firefox. I have even tried to make pressure to 1password about that, without much success: https://discussions.agilebits.com/discussion/comment/410603/#Comment_410603 https://discussions.agilebits.com/discussion/comment/410603/...
  - philliphaydon 8y ago
    I’m using Bitwarden on budgie / Firefox. Works great.
    - izietto 8y ago
      Thank you! I'll evaluate it
  - pluma 8y ago
    BitWarden works fine. I'm using Linux/Firefox as well, the rest of the time is on Windows/Chrome. It's 100% open source: https://bitwarden.com/ https://bitwarden.com/
    - spanishgum 8y ago
      I stopped using browser based password managers and switched to KeePass. It's a bit more work to pull passwords and back them up, but for me it beats trusting cloud services with security critical data.
cricalix 8y ago
The most 1Password has ever done (in my experience) is submit after I select the login to use, even on sites with only one login. I disabled that aspect, and I always have to toggle the helper via ctrl/cmd-\. It has never pre-filled a login field without me asking it to, and that's across v4, v5, v6, and v7.
liamfd 8y ago
I've never seen last password auto fill, I've always had to use cmd+\. What browser were you using?
toxik 8y ago
FWIW Apple's Web browser Safari recently switched to this approach, both on iOS and macOS.
- akvadrako 8y ago
  For reference: https://www.cultofmac.com/538447/ios-11-3-safari-security/ https://www.cultofmac.com/538447/ios-11-3-safari-security/
nvr219 8y ago
My 1password only autofills if I do ctrl+\, otherwise it does nothing.
notheguyouthink 8y ago
Note, that's if you use autofill at all. I use an installed 1Password app, and avoid browser autofill extensions like the plague. Browser extensions don't have a good track record I believe, regardless of company. I don't blame the companies, I blame browser extensions. I see little benefit in autofill integration, I just click the button in my task bar, click copy, and paste. LastPass has been pretty sketchy in the past too, I don't trust them. I've been quite happy with 1Password, fwiw.
djsumdog 8y ago
I still use a pretty complex password algorithm: https://penguindreams.org/blog/password-algorithms/ https://penguindreams.org/blog/password-algorithms/ I like not having my passwords tied to a device, private key I could lose, etc. With an algorithm, I can still avoid credential stuffing, since all my account use totally different secure passwords, but I can derive them without having to look them up. I realize someone could figure out my algorithm, but they'd probably need several of my passwords and at that point you're talking about a targeted attack.
- ISL 8y ago
  What do you do when you're asked to rotate your password every ninety days?
  - michaelmior 8y ago
    Not the parent, but I've haven't been asked this in years. I do periodically change important passwords, but I can't recall being forced to.
  - djsumdog 8y ago
    Most normal websites don't make you rotate password. When a site has a breech and forces me to change it, I do have an addition to my algorithm for that. I use Keepass to store passwords that violate my algorithm (sites that don't allow my special chars, or that say my password is too long, etc.) I'm on my third iteration of password algorithms. I use my password manager to store which algorithm I'm using for which site and try to update old ones to new ones as I encounter/use them. There aren't that many exceptions to my rules, so I can usually remember those exceptions if I use them frequently enough. Machine accounts that require rotation get their own special secure password that I don't use anywhere else.
Lazare 8y ago
That's....simply not true? I've been using 1password for many years, and that's not how 1password works for me. There might be a setting to enable that behaviour somewhere, but by default, it doesn't autofill without prompting. That's true for every version, OS, browser plugin, desktop app, mobile, etc. Edit: I just saw your comment that it was actually Dashlane that autofilled! Nevermind then. :)

Cynddl 8y ago

Bitwarden has auto-fill disabled by default, and only enables it with a warning (“Use at your own risk”).

BartBoch 8y ago
Good to know, the more alternatives the better.

jplatte 8y ago

The KeePassXC browser integration also does it the way you describe where you choose a profile instead of having the firm already filled in when the page loads.

joshvm 8y ago

Is this new behaviour? In the version of 1Password I have (6.8.8, Mac) it detects the website, but I have to click on the specific login using 1Password Mini to fill the fields. It's never done it automatically as far as I can tell. It tends to be browsers which are gung-ho about automatically filling in login details.

BartBoch 8y ago
Nope, I have used 1Password most of last year, maybe they changed it after the data harvesting attack from a few months ago, but for me, the tool was very aggressive in submitting data without me interacting with the website. At the time LastPass was the only major player with "click to launch" feature.
- have_faith 8y ago
  > data harvesting attack Think I missed that, what happened? I don't enable 1Password autofill or any of it's browser extensions, I just see it as additional attack vectors waiting to be compromised.
  - BartBoch 8y ago
    https://www.howtogeek.com/338209/you-should-turn-off-autofill-in-your-password-manager/ https://www.howtogeek.com/338209/you-should-turn-off-autofil...
    - BonesJustice 8y ago
      From your link: > 1Password isn’t affected by this problem because it doesn’t include an automatic autofill feature. Are you sure we’re talking about the same app? I’ve used 1Password for years, and it’s never autofilled for me. Maybe it was actually your browser’s built-in keyring?
      - notheguyouthink 8y ago
        I think they're confusing the 1Password browser extension. 1Password has a native app, which I use on both windows and osx, and I just don't install their browser extension for autofill features. Though, given that I avoid autofill like the plague, I could easily be misunderstanding the issue too. I'm speaking of a subject I don't use, I don't think anyone should haha.
        rootusrootus 8y ago
        I use the browser extension. It does not autofill. I have to open the extension and then select the site before it will fill any form fields.
    - BartBoch 8y ago
      Sorry, I completely screwed here. I think I am way overworked. It's Dashlane that I was using, not 1Password. After Dashlane I was using 1Password for a week but it was not for me, moved to Padlock and now with LastPass. I have migrated to 1Pass and then from it to LastPass, thus the confusion. I checked the history of my backups and somehow forgot about my migration from Dashlane that was the initial tool that would do autofills. Sorry for the confusion, I've should check that more thoroughly. A good sign for me it is time for a walk.

dzhiurgis 8y ago

LastPass have a horrible security track record. I’ve even caught them editing their wiki page, trying to erase their past, which was reverted thanks to HN.

BartBoch 8y ago
Yeah, by no means I am an ambassador of them. For me, it was so-so vs bad really.
izietto 8y ago
Not-so-happy LastPass user here: I evaluated alternatives, but LastPass is the only one which somehow works on Linux/Firefox. I have even tried to make pressure to 1password about that, without much success: https://discussions.agilebits.com/discussion/comment/410603/#Comment_410603 https://discussions.agilebits.com/discussion/comment/410603/...
- philliphaydon 8y ago
  I’m using Bitwarden on budgie / Firefox. Works great.
  - izietto 8y ago
    Thank you! I'll evaluate it
- pluma 8y ago
  BitWarden works fine. I'm using Linux/Firefox as well, the rest of the time is on Windows/Chrome. It's 100% open source: https://bitwarden.com/ https://bitwarden.com/
  - spanishgum 8y ago
    I stopped using browser based password managers and switched to KeePass. It's a bit more work to pull passwords and back them up, but for me it beats trusting cloud services with security critical data.

cricalix 8y ago

The most 1Password has ever done (in my experience) is submit after I select the login to use, even on sites with only one login. I disabled that aspect, and I always have to toggle the helper via ctrl/cmd-\. It has never pre-filled a login field without me asking it to, and that's across v4, v5, v6, and v7.

liamfd 8y ago

I've never seen last password auto fill, I've always had to use cmd+\. What browser were you using?

toxik 8y ago

FWIW Apple's Web browser Safari recently switched to this approach, both on iOS and macOS.

akvadrako 8y ago
For reference: https://www.cultofmac.com/538447/ios-11-3-safari-security/ https://www.cultofmac.com/538447/ios-11-3-safari-security/

nvr219 8y ago

My 1password only autofills if I do ctrl+\, otherwise it does nothing.

notheguyouthink 8y ago

Note, that's if you use autofill at all. I use an installed 1Password app, and avoid browser autofill extensions like the plague. Browser extensions don't have a good track record I believe, regardless of company. I don't blame the companies, I blame browser extensions. I see little benefit in autofill integration, I just click the button in my task bar, click copy, and paste. LastPass has been pretty sketchy in the past too, I don't trust them. I've been quite happy with 1Password, fwiw.

djsumdog 8y ago

I still use a pretty complex password algorithm: https://penguindreams.org/blog/password-algorithms/ https://penguindreams.org/blog/password-algorithms/ I like not having my passwords tied to a device, private key I could lose, etc. With an algorithm, I can still avoid credential stuffing, since all my account use totally different secure passwords, but I can derive them without having to look them up. I realize someone could figure out my algorithm, but they'd probably need several of my passwords and at that point you're talking about a targeted attack.

ISL 8y ago
What do you do when you're asked to rotate your password every ninety days?
- michaelmior 8y ago
  Not the parent, but I've haven't been asked this in years. I do periodically change important passwords, but I can't recall being forced to.
- djsumdog 8y ago
  Most normal websites don't make you rotate password. When a site has a breech and forces me to change it, I do have an addition to my algorithm for that. I use Keepass to store passwords that violate my algorithm (sites that don't allow my special chars, or that say my password is too long, etc.) I'm on my third iteration of password algorithms. I use my password manager to store which algorithm I'm using for which site and try to update old ones to new ones as I encounter/use them. There aren't that many exceptions to my rules, so I can usually remember those exceptions if I use them frequently enough. Machine accounts that require rotation get their own special secure password that I don't use anywhere else.

Lazare 8y ago

That's....simply not true? I've been using 1password for many years, and that's not how 1password works for me. There might be a setting to enable that behaviour somewhere, but by default, it doesn't autofill without prompting. That's true for every version, OS, browser plugin, desktop app, mobile, etc. Edit: I just saw your comment that it was actually Dashlane that autofilled! Nevermind then. :)