4 ms·
What's the benefit of doing it that way?
by jakelazaroff 8y ago
What's the benefit of doing it that way?
- dontbenebby 8y agoI've seen some CVEs where malicious websites induce your browser to autofill (basically steal passwords). So the intention is that I stop some script from siphoning my passwords. This admittedly opens me up to phishing, but to mitigate I also have containers set up for various facets of my life. (So it's a big red flag if what's supposedly my bank doesn't open in the "bank" container".) Edit: I also value storing the database locally versus "in the cloud"
- wccrawford 8y agoThat's why you should turn off auto-fill.
- saagarjha 8y agoThis is why most password managers no longer autofill without user interaction.
- FabHK 8y agoYour web browser doesn't have any connection to your password manager. Who knows what your web browser is doing, why would you give it any access to your credentials?
- donarb 8y agoThe Safari browser can be linked to the Keychain Manager, both products coming from Apple.
- icebraining 8y agoHow can you not give your browser your credentials? Do you login on a site using curl and manually copy session cookies?
- FabHK 8y agoYou can manually copy over one credential at a time - no need to connect the browser to your entire bucket of credentials.
- wccrawford 8y agoHe gets to have the added insecurity if putting it on his clipboard for other programs to see on the way by. /s I actually can't imagine how it could be safer than having the password manager do it directly.
- dontbenebby 8y agoMy manager autoclears the paste buffer.
- pwg 8y ago> He gets to have the added insecurity if putting it on his clipboard for other programs to see on the way by. If the local system is trustworthy, then none of the other programs are sniffing the clipboard looking to harvest passwords. And therefore there is no issue here. If the local system is untrustworthy and contains malware sniffing the clipboard looking to harvest passwords, then using or not using a password manager is irrelevant [1]. Instead there is a bigger issue needing cleaning up, that of returning the local system to a trustworthy state. [1] because an untrustworthy local system running clipboard sniffing malware is also likely running key logging malware, so even if the passwords were only ever memorized they will still get captured whenever they are typed in.
- saagarjha 8y agoThis is not necessarily true. iOS, for example, does not allow for key logging but will happily allow Facebook to grab whatever you have on your clipboard, which it does of course because it's Facebook.
- CM30 8y agoMakes you use the password manager credentials to access your login credentials for other services. Works to stop nosy coworkers, siblings, spouses, etc.
- alarge 8y agoNot sure I understand your point here. You need to use your password manager credentials to autofill also (at least for 1Password). The only reason to copy/paste is if you don't think your password manager will put the right info into the right boxes.