3 ms·

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software o

by shpx 7y ago

I like Chrome/Chromium's password manager. You just login the first time you open it and it autofills passwords. Don't have to install any additional software or configure anything, and it'll also autosuggest passwords you saved on websites in Android apps. The only thing I miss sometimes is you can't manually add passwords.

identity0 7y ago
Pretty sure every single modern browsers has that. The downside with using chrome is handing all your browsing history and bookmarks to Google.
- judge2020 7y ago
  Unless they on-the-fly decrypt your chrome sync (which would require non-encrypted password storing), the stuff you sync to Google is encrypted with your Google password, and if you're paranoid, you can encrypt the sync with a separate password.
  - bigiain 7y ago
    > the stuff you sync to Google is encrypted with your Google password Your Google Password is also available to Google. (At least every time you log in, even if they properly hash and discarded it after authenticating you and just use a token from there.)
  - deleted 7y ago
    [deleted]
hellcow 7y ago
Last I checked, Chrome on desktop stores all your passwords in plaintext on disk. Unless something's changed... I wouldn't use that. Firefox at least offers you the ability to set a master password to encrypt all the rest.
- butteroverflow 7y ago
  Well, on Windows Chrome does use the system crypto API and encrypts, I believe, your whole profile, but only if you have a password set on your system account.
- pvg 7y ago
  It doesn't anymore, unless last time you checked was quite a while ago. But it probably wasn't such a dreadful thing even when they were doing it.
kerng 7y ago
The attack surface of a browser makes it a perfect target - I would not advise storing any critical passwords with the browser or in close reach to the browser.
- pvg 7y ago
  You're going to be entering these passwords into a browser most of the time so if a compromised browser is your problem, no password manager is really going to help you.
  - blackoil 7y ago
    That depends on time between compromise and detection. With password manager you'll lose only passwords for sites you actually logged in to. While with browser, you'll lose all passwords instantly.
    - pvg 7y ago
      I'm not sure I follow. If your browser is compromised that's it - it's compromised for everything. Your system is compromised. If I have control over your browser, I don't really need your passwords although I can likely get them out of whatever local password manager you have, to boot.
      - kerng 7y ago
        That's not how it works always. There are tons of compromises that do not imply system compromise, like XSS, or arbitrary browser process memory reads, or extension bugs, or java ghost scripts, etc...
        tptacek 7y ago
        XSS isn't a browser compromise. What's a "java ghost script"?
  - kerng 7y ago
ggg2 7y ago
can't tell if you are joking or not. I highly suggest you read chrome's privacy policy on that password sync feature. Hint: when enabled on android the wifi password is unencrypted (or reversible, which is close to the same thing. they claim it must be so to work with wear)

by shpx 7y ago

identity0 7y ago

Pretty sure every single modern browsers has that. The downside with using chrome is handing all your browsing history and bookmarks to Google.

judge2020 7y ago
Unless they on-the-fly decrypt your chrome sync (which would require non-encrypted password storing), the stuff you sync to Google is encrypted with your Google password, and if you're paranoid, you can encrypt the sync with a separate password.
- bigiain 7y ago
  > the stuff you sync to Google is encrypted with your Google password Your Google Password is also available to Google. (At least every time you log in, even if they properly hash and discarded it after authenticating you and just use a token from there.)
- deleted 7y ago
  [deleted]

hellcow 7y ago

Last I checked, Chrome on desktop stores all your passwords in plaintext on disk. Unless something's changed... I wouldn't use that. Firefox at least offers you the ability to set a master password to encrypt all the rest.

butteroverflow 7y ago
Well, on Windows Chrome does use the system crypto API and encrypts, I believe, your whole profile, but only if you have a password set on your system account.
pvg 7y ago
It doesn't anymore, unless last time you checked was quite a while ago. But it probably wasn't such a dreadful thing even when they were doing it.

kerng 7y ago

The attack surface of a browser makes it a perfect target - I would not advise storing any critical passwords with the browser or in close reach to the browser.

pvg 7y ago
You're going to be entering these passwords into a browser most of the time so if a compromised browser is your problem, no password manager is really going to help you.
- blackoil 7y ago
  That depends on time between compromise and detection. With password manager you'll lose only passwords for sites you actually logged in to. While with browser, you'll lose all passwords instantly.
  - pvg 7y ago
    I'm not sure I follow. If your browser is compromised that's it - it's compromised for everything. Your system is compromised. If I have control over your browser, I don't really need your passwords although I can likely get them out of whatever local password manager you have, to boot.
    - kerng 7y ago
      That's not how it works always. There are tons of compromises that do not imply system compromise, like XSS, or arbitrary browser process memory reads, or extension bugs, or java ghost scripts, etc...
      - tptacek 7y ago
        XSS isn't a browser compromise. What's a "java ghost script"?
- kerng 7y ago

ggg2 7y ago

can't tell if you are joking or not. I highly suggest you read chrome's privacy policy on that password sync feature. Hint: when enabled on android the wifi password is unencrypted (or reversible, which is close to the same thing. they claim it must be so to work with wear)