4 ms·

Wasn't fully aware of this. I think most 'hacker-friendly' password managers (like password-store), that are unix-y, can be persisted to git, don't depend on m

by vemv 8y ago

Wasn't fully aware of this. I think most 'hacker-friendly' password managers (like password-store), that are unix-y, can be persisted to git, don't depend on megacorps, etc lack these capabilities? i.e. very few password managers might count as 'decent'. As a last note, a browser extension that doesn't come from Google or Apple shouldn't be trusted. I have zero extensions (other than uBlock), since they essentially have arbitary read/write capabilites into one's digital life. What's really missing is a OS-level widget that acts as a secure clipboard. Similar to how one inserts emojis in macOS.

pvg 8y ago
i.e. very few password managers might count as 'decent'. I think this is true - this is really core browser functionality and all password managers are fundamentally hacks. A tiny number of these hacks are non-awful. 'hacker-friendly' password management is a bit like 'hacker-friendly' dentistry - useful to a tiny minority of exceptionally adventurous people. The safest, sanest thing you can do is use the browser-provided password manager and the browser- or OS- provided sync. Both Safari's and Chrome's use end-to-end encryption (you have to turn it on in Chrome but it's there). The benefits of this far outweigh the downsides, to the point where I actually think the typical recommendation for 1Password is a bit outdated and counter-productive. Browser and platform vendors should obviate the need for this entire class of software and they seem to be moving in that direction.
tialaramex 8y ago
I use PassFF which does Firefox integration for pass (and thus you get all the usual pass features, git integration, etcetera). I have no idea why you feel proprietary goop from Apple is trustworthy while code I can read for myself is not. Personally I have auto-fill configured. Since I fixed (in my copy and since the PR was accepted eventually everyone's) the lack of any suffix matching beyond TLDs I feel auto-fill security implications are tolerable, I'm sure views vary. But I definitely couldn't put up with manual copy & paste.
- vemv 8y ago
  Fair observation, thanks for sharing. I'll start looking into https://github.com/browserpass/browserpass/ https://github.com/browserpass/browserpass/ .

by vemv 8y ago

pvg 8y ago

i.e. very few password managers might count as 'decent'. I think this is true - this is really core browser functionality and all password managers are fundamentally hacks. A tiny number of these hacks are non-awful. 'hacker-friendly' password management is a bit like 'hacker-friendly' dentistry - useful to a tiny minority of exceptionally adventurous people. The safest, sanest thing you can do is use the browser-provided password manager and the browser- or OS- provided sync. Both Safari's and Chrome's use end-to-end encryption (you have to turn it on in Chrome but it's there). The benefits of this far outweigh the downsides, to the point where I actually think the typical recommendation for 1Password is a bit outdated and counter-productive. Browser and platform vendors should obviate the need for this entire class of software and they seem to be moving in that direction.

tialaramex 8y ago

I use PassFF which does Firefox integration for pass (and thus you get all the usual pass features, git integration, etcetera). I have no idea why you feel proprietary goop from Apple is trustworthy while code I can read for myself is not. Personally I have auto-fill configured. Since I fixed (in my copy and since the PR was accepted eventually everyone's) the lack of any suffix matching beyond TLDs I feel auto-fill security implications are tolerable, I'm sure views vary. But I definitely couldn't put up with manual copy & paste.

vemv 8y ago
Fair observation, thanks for sharing. I'll start looking into https://github.com/browserpass/browserpass/ https://github.com/browserpass/browserpass/ .