4 ms·
The attack surface of a browser makes it a perfect target - I would not advise storing any critical passwords with the browser or in close reach to the browser.
by kerng 7y ago
The attack surface of a browser makes it a perfect target - I would not advise storing any critical passwords with the browser or in close reach to the browser.
- pvg 7y agoYou're going to be entering these passwords into a browser most of the time so if a compromised browser is your problem, no password manager is really going to help you.
- blackoil 7y agoThat depends on time between compromise and detection. With password manager you'll lose only passwords for sites you actually logged in to. While with browser, you'll lose all passwords instantly.
- pvg 7y agoI'm not sure I follow. If your browser is compromised that's it - it's compromised for everything. Your system is compromised. If I have control over your browser, I don't really need your passwords although I can likely get them out of whatever local password manager you have, to boot.
- kerng 7y agoThere are many different ways to get compromised. Reducing attack surface is always a good idea. And, yes I do close all browser windows/processes before login, and after logout of important websites for instance to make sure cookies and passwords are gone from browser memory.
- pvg 7y agoI don't think this really addresses my point. You're saying the in-browser password manager is somehow more dangerous than some external password manager. I don't think this is true. And the browser presents the same attack surface if you're, you know, using the browser. If your browser is a vector for successful compromise, you're boned if you use the browser, whatever elaborate protective ritual you follow while using it.
- kerng 7y ago>> You're saying the in-browser password manager is somehow more dangerous than some external password manager. Correct.