3 ms·

I see multiple complaints about breaking password manager workflows, but Keepass has allowed me for years to use any simulated input sequence for credentials.

I see multiple complaints about breaking password manager workflows, but Keepass has allowed me for years to use any simulated input sequence for credentials. I have many passwords configured with: 1. Type username 2. Type <ret> 3. Pause 750ms 4. Type password 5. Type <ret> Some need an extra tab in there to give the password field focus for input. I have a short template for this, so I can just copy-paste the input sequence into any new password.

robk 7y ago
Except an error will lead to your password being typed in plaintext potentially if the timeout expires and the focus goes back to the login field or another field or url bar
- greggyb 7y ago
  What is the threat model here? How am I compromised if part of my password gets typed somewhere else? It's already plaintext when it's typed. If there's a keylogger on my machine, they're getting the password. If it's typed into another field, I'm really not concerned. I'm not logged in yet. So if it gets typed somewhere and submitted through a form, it may end up in a log somewhere un-associated with my username. If the concern is that it's seen in public, this is valid, I guess, but not a concern for me. I access private services in private. Probably 90% of my computing is done in my home.
  - panic 7y ago
    Your browser could crash during step 3, moving focus to the next open window. This window could be a chat window. It's an unlikely situation, but it's not inconceivable.
    - greggyb 7y ago
      This is not a concern in my threat model.
stronglikedan 7y ago
I think the login form should accommodate the layman. It's hard enough to get the layman to use a password manager, much less script it.
- greggyb 7y ago
  Sure. I was responding explicitly to concerns about multi-page login workflows breaking password managers. My response is about using a password manager that can support these login workflows. The layman is not concerned with the issue I was responding to. I agree with you that the login forms should be better. But I am making a point that "it breaks my password manager" can be answered with "get a better password manager, or learn better how to use yours."
  - stronglikedan 7y ago
    My point is that it does break password manager workflows, since you have to go above and beyond the comfort level of a layman to circumvent the broken login workflow.

robk 7y ago

Except an error will lead to your password being typed in plaintext potentially if the timeout expires and the focus goes back to the login field or another field or url bar

greggyb 7y ago
What is the threat model here? How am I compromised if part of my password gets typed somewhere else? It's already plaintext when it's typed. If there's a keylogger on my machine, they're getting the password. If it's typed into another field, I'm really not concerned. I'm not logged in yet. So if it gets typed somewhere and submitted through a form, it may end up in a log somewhere un-associated with my username. If the concern is that it's seen in public, this is valid, I guess, but not a concern for me. I access private services in private. Probably 90% of my computing is done in my home.
- panic 7y ago
  Your browser could crash during step 3, moving focus to the next open window. This window could be a chat window. It's an unlikely situation, but it's not inconceivable.
  - greggyb 7y ago
    This is not a concern in my threat model.

stronglikedan 7y ago

I think the login form should accommodate the layman. It's hard enough to get the layman to use a password manager, much less script it.

greggyb 7y ago
Sure. I was responding explicitly to concerns about multi-page login workflows breaking password managers. My response is about using a password manager that can support these login workflows. The layman is not concerned with the issue I was responding to. I agree with you that the login forms should be better. But I am making a point that "it breaks my password manager" can be answered with "get a better password manager, or learn better how to use yours."
- stronglikedan 7y ago
  My point is that it does break password manager workflows, since you have to go above and beyond the comfort level of a layman to circumvent the broken login workflow.