4 ms·

I have always somewhat naively assumed it is best to never use a password manager plugin but instead use a separate binary with less convenient integration to r

by sgc 8y ago

I have always somewhat naively assumed it is best to never use a password manager plugin but instead use a separate binary with less convenient integration to reduce the possibility of browser exploits exposing my entire password db. Is there any truth to that?

chowells 8y ago
It's a tradeoff. You get that advantage, but then you open yourself up to phishing attacks that browser plugins avoid by checking the domain. My ideal would be a browser plugin that sends the domain, and nothing more, to a standalone process.
- tempay 8y ago
  This is how 1Password works
- PurpleRamen 8y ago
  A bit more must still be done. The browser-plugin must find the fields to fill with the data. It must also allow adding new entrys or changing existing entrys. Actually finding the correct username-field seems to be slightly more complex on a bad designed page, because it has no special type like the password-field. Oh, do we know whether it's really just a simple passwordmanager, and not also some autofill-manager, session-restorer, or other security/comfort-snakeoil?
- cyphar 8y ago
  That's how KeePassXC works. And in addition, KeePassXC will prompt you and tell you what passwords are going to be provided to your browser.
dancek 8y ago
I don't think that's naive. A browser plugin is another component that you have to trust. But maybe you haven't considered all threats. I use the Chrome password store. Copying passwords over clipboard seems quite unsafe to me. And I have to trust my browser with my passwords anyway, even if I use no password manager at all. Of course, if you (really) control all software running on your machine, the clipboard is no issue. But I'm lazy and don't have the time to read all source code and compile everything myself. The downside is that I've considered changing to Firefox as my primary browser a couple of times, but the passwords make switching harder.
- paulryanrogers 8y ago
  Some password managers like Keepass put the password into the clipboard only temporarily. And their Auto-type actually splits input among simulated key presses and clipboard data.
  - dancek 8y ago
    Good to know! I'll have to consider switching to Keepass, then.
  - sgc 8y ago
    This is what I use. Although it is not perfect, it does require an exploit targeting it specifically. Until it becomes a de facto standard, I would expect this type of exploit to be found largely in targeted attack on an individual or specific organization rather than in a broadly sweeping virus.
palant 8y ago
Not so much browser exploits, but the browser extensions often have issues. If your password manager is a separate binary, you usually don't have to worry about websites exploiting it. On the other hand, it won't protect you against phishing attacks (it doesn't know what site you are on) and will usually require that you to handle passwords via the clipboard.
- SlowRobotAhead 8y ago
  Isn't it worth noting that LastPass / Dashlane / and others claim they are storing your binary blob on their cloud to be decrypted only on your machine and never theirs? I think that's an area between "we store your passwords on our server" and "this file I store has all my passwords". No?
  - palant 8y ago
    At least in case of LastPass you shouldn't buy the marketing statements. Not only isn't it really a binary blob that they are storing, they don't really care about protecting it from themselves either. https://palant.de/2018/07/09/is-your-lastpass-data-really-safe-in-the-encrypted-online-vault https://palant.de/2018/07/09/is-your-lastpass-data-really-sa...
deleted 8y ago
[deleted]

by sgc 8y ago

chowells 8y ago

It's a tradeoff. You get that advantage, but then you open yourself up to phishing attacks that browser plugins avoid by checking the domain. My ideal would be a browser plugin that sends the domain, and nothing more, to a standalone process.

tempay 8y ago
This is how 1Password works
PurpleRamen 8y ago
A bit more must still be done. The browser-plugin must find the fields to fill with the data. It must also allow adding new entrys or changing existing entrys. Actually finding the correct username-field seems to be slightly more complex on a bad designed page, because it has no special type like the password-field. Oh, do we know whether it's really just a simple passwordmanager, and not also some autofill-manager, session-restorer, or other security/comfort-snakeoil?
cyphar 8y ago
That's how KeePassXC works. And in addition, KeePassXC will prompt you and tell you what passwords are going to be provided to your browser.

dancek 8y ago

I don't think that's naive. A browser plugin is another component that you have to trust. But maybe you haven't considered all threats. I use the Chrome password store. Copying passwords over clipboard seems quite unsafe to me. And I have to trust my browser with my passwords anyway, even if I use no password manager at all. Of course, if you (really) control all software running on your machine, the clipboard is no issue. But I'm lazy and don't have the time to read all source code and compile everything myself. The downside is that I've considered changing to Firefox as my primary browser a couple of times, but the passwords make switching harder.

paulryanrogers 8y ago
Some password managers like Keepass put the password into the clipboard only temporarily. And their Auto-type actually splits input among simulated key presses and clipboard data.
- dancek 8y ago
  Good to know! I'll have to consider switching to Keepass, then.
- sgc 8y ago
  This is what I use. Although it is not perfect, it does require an exploit targeting it specifically. Until it becomes a de facto standard, I would expect this type of exploit to be found largely in targeted attack on an individual or specific organization rather than in a broadly sweeping virus.

palant 8y ago

Not so much browser exploits, but the browser extensions often have issues. If your password manager is a separate binary, you usually don't have to worry about websites exploiting it. On the other hand, it won't protect you against phishing attacks (it doesn't know what site you are on) and will usually require that you to handle passwords via the clipboard.

SlowRobotAhead 8y ago
Isn't it worth noting that LastPass / Dashlane / and others claim they are storing your binary blob on their cloud to be decrypted only on your machine and never theirs? I think that's an area between "we store your passwords on our server" and "this file I store has all my passwords". No?
- palant 8y ago
  At least in case of LastPass you shouldn't buy the marketing statements. Not only isn't it really a binary blob that they are storing, they don't really care about protecting it from themselves either. https://palant.de/2018/07/09/is-your-lastpass-data-really-safe-in-the-encrypted-online-vault https://palant.de/2018/07/09/is-your-lastpass-data-really-sa...

deleted 8y ago

[deleted]