6 ms·

It's healthy to not use autofill, and to not have your password manager integrate with your browser, and to use an ad blocker that blocks analytics stuff includ

It's healthy to not use autofill, and to not have your password manager integrate with your browser, and to use an ad blocker that blocks analytics stuff including intercom, segment, etc.

briandear 8y ago
Blocking intercom? Intercom doesn’t do creepy stuff.
jacobsenscott 8y ago
Yes. Do all that stuff. You're still being watched at all times.
geofft 8y ago
Having your password manager integrate with your browser is one of the best defenses against phishing, though. It will only fill the password if the origin matches.
- ploxiln 8y ago
  ... or if there's a bug, or if the bridge from the extension to the page content has a mistake that lets javascript on the page control it. That's actually happened to all the major vendors like LastPass and OnePass, and to some of them it's happened the exact same way multiple times - a UI re-design re-introduces the same JS interop mistake. some linky links: https://twitter.com/taviso/status/941711305668411393 https://twitter.com/taviso/status/941711305668411393 https://twitter.com/taviso/status/769378052254015488 https://twitter.com/taviso/status/769378052254015488 I've promoted password managers for a long time! Just not fancy convenient commercial ones, those are a huge mistake.
  - geofft 8y ago
    To my knowledge, 1Password (which is what I use) has never had one of these bugs. There is one flaw reported in the P0 bugtracker against 1Password, that another user on the same local machine running native code can trick the 1Password agent into believing that it's your browser extension https://crbug.com/project-zero/888 https://crbug.com/project-zero/888 . All the machines where I run 1Password are single-user machines, so local processes running as other users aren't within my threat model anyway. (And I think this is 95%+ of people's threat models too on the machines where they run 1Password, although I understand why 1Password attempted to defend against this risk.) 1Password wrote an extended post in response to that vulnerability talking about defenses and threat models https://discussions.agilebits.com/discussion/70301/background-for-4-6-1-security-changes https://discussions.agilebits.com/discussion/70301/backgroun... and I don't see evidence that the vulnerability ever recurred. And it was not a threat that allowed one website to get passwords for another website. It's true that other password managers have had such vulnerabilities - multiple times - but that's a reason to comparison-shop the various password managers and pick a secure one, not to write off the product category entirely.

It's healthy to not use autofill, and to not have your password manager integrate with your browser, and to use an ad blocker that blocks analytics stuff including intercom, segment, etc.

briandear 8y ago

Blocking intercom? Intercom doesn’t do creepy stuff.

jacobsenscott 8y ago

Yes. Do all that stuff. You're still being watched at all times.

geofft 8y ago

Having your password manager integrate with your browser is one of the best defenses against phishing, though. It will only fill the password if the origin matches.

ploxiln 8y ago
... or if there's a bug, or if the bridge from the extension to the page content has a mistake that lets javascript on the page control it. That's actually happened to all the major vendors like LastPass and OnePass, and to some of them it's happened the exact same way multiple times - a UI re-design re-introduces the same JS interop mistake. some linky links: https://twitter.com/taviso/status/941711305668411393 https://twitter.com/taviso/status/941711305668411393 https://twitter.com/taviso/status/769378052254015488 https://twitter.com/taviso/status/769378052254015488 I've promoted password managers for a long time! Just not fancy convenient commercial ones, those are a huge mistake.
- geofft 8y ago
  To my knowledge, 1Password (which is what I use) has never had one of these bugs. There is one flaw reported in the P0 bugtracker against 1Password, that another user on the same local machine running native code can trick the 1Password agent into believing that it's your browser extension https://crbug.com/project-zero/888 https://crbug.com/project-zero/888 . All the machines where I run 1Password are single-user machines, so local processes running as other users aren't within my threat model anyway. (And I think this is 95%+ of people's threat models too on the machines where they run 1Password, although I understand why 1Password attempted to defend against this risk.) 1Password wrote an extended post in response to that vulnerability talking about defenses and threat models https://discussions.agilebits.com/discussion/70301/background-for-4-6-1-security-changes https://discussions.agilebits.com/discussion/70301/backgroun... and I don't see evidence that the vulnerability ever recurred. And it was not a threat that allowed one website to get passwords for another website. It's true that other password managers have had such vulnerabilities - multiple times - but that's a reason to comparison-shop the various password managers and pick a secure one, not to write off the product category entirely.