4 ms·

Is Firefox trying to replicate all behavior of password managers?

Groxx 7y ago
Browsers that offer to save your passwords are password managers. They've just been downright abhorrent at it for years. Improving that seems worth doing?
- woodrowbarlow 7y ago
  they certainly aren't as bad as they used to be, but the UX hasn't improved much. in-browser password managers these days have acceptable security and features like the one in the article are starting to surpass other password managers. but gawd, the UX. my biggest qualm with the UX of firefox's password manager is the "master password" feature. it's a password you must enter to unlock your keychain. that's a must-have for me. what firefox does wrong: * it's rendered as a simple dialog prompt, identical to javascript's window.prompt. could be faked by a site for phishing. * the unlock prompt launches once, about 30 seconds after the browser is launched (right while i'm in the middle of typing a URL) and grabs focus. * if you don't provide a password, the prompt will show up again each time you visit a page that has a login form for which you have a saved password, even if the login form is hidden with CSS. many sites have login forms on every page. * there's no way to unlock the keychain on a per-site basis or lock it again once you've unlocked it (besides closing the browser). what i want is: * when i'm about to log in to a site, i expect to provide my master password and have firefox autofill my saved password for this site only. * if i need the password again later, or a password for a different site, i expect to have to provide my master password again. * a dialogue that i can trust to have come from the browser itself rather than the webpage. * not to be interrupted by the dialogue unless i need to access a saved password.
  - Groxx 7y ago
    They seem to be working on the password manager in general lately(ish) e.g. https://lockwise.firefox.com/ https://lockwise.firefox.com/ , so I think there's a decent chance that side of things will improve. Because yeah, it has been an awful, nigh-unchanged experience for pretty much its whole existence.
    - woodrowbarlow 7y ago
      i hope so! i've seen a lot of recent announcements related to saved passwords. but so far none of them have been about the UX.
- bovermyer 7y ago
  Oh, I'm not opposed to Mozilla doing this. I'm just curious if they intend to fully replace third-party password managers.
  - cpeterso 7y ago
    Mozilla is building a standalone password manager app for Android and iOS called "Lockwise" (formerly "Lockbox") that will also integrate with Firefox: https://lockwise.firefox.com/ https://lockwise.firefox.com/
    - Groxx 7y ago
      ^ yea. My guess is that they're trying to improve the basics to the point where third party ones aren't necessary, which I'm fully in favor of. I don't really think there's any risk to them removing other managers, just competing.
sp332 7y ago
Yeah, in fact they've launched a password manager app. https://lockwise.firefox.com/ https://lockwise.firefox.com/

Browsers that offer to save your passwords are password managers. They've just been downright abhorrent at it for years. Improving that seems worth doing?

woodrowbarlow 7y ago
they certainly aren't as bad as they used to be, but the UX hasn't improved much. in-browser password managers these days have acceptable security and features like the one in the article are starting to surpass other password managers. but gawd, the UX. my biggest qualm with the UX of firefox's password manager is the "master password" feature. it's a password you must enter to unlock your keychain. that's a must-have for me. what firefox does wrong: * it's rendered as a simple dialog prompt, identical to javascript's window.prompt. could be faked by a site for phishing. * the unlock prompt launches once, about 30 seconds after the browser is launched (right while i'm in the middle of typing a URL) and grabs focus. * if you don't provide a password, the prompt will show up again each time you visit a page that has a login form for which you have a saved password, even if the login form is hidden with CSS. many sites have login forms on every page. * there's no way to unlock the keychain on a per-site basis or lock it again once you've unlocked it (besides closing the browser). what i want is: * when i'm about to log in to a site, i expect to provide my master password and have firefox autofill my saved password for this site only. * if i need the password again later, or a password for a different site, i expect to have to provide my master password again. * a dialogue that i can trust to have come from the browser itself rather than the webpage. * not to be interrupted by the dialogue unless i need to access a saved password.
- Groxx 7y ago
  They seem to be working on the password manager in general lately(ish) e.g. https://lockwise.firefox.com/ https://lockwise.firefox.com/ , so I think there's a decent chance that side of things will improve. Because yeah, it has been an awful, nigh-unchanged experience for pretty much its whole existence.
  - woodrowbarlow 7y ago
    i hope so! i've seen a lot of recent announcements related to saved passwords. but so far none of them have been about the UX.
bovermyer 7y ago
Oh, I'm not opposed to Mozilla doing this. I'm just curious if they intend to fully replace third-party password managers.
- cpeterso 7y ago
  Mozilla is building a standalone password manager app for Android and iOS called "Lockwise" (formerly "Lockbox") that will also integrate with Firefox: https://lockwise.firefox.com/ https://lockwise.firefox.com/
  - Groxx 7y ago
    ^ yea. My guess is that they're trying to improve the basics to the point where third party ones aren't necessary, which I'm fully in favor of. I don't really think there's any risk to them removing other managers, just competing.

sp332 7y ago

Yeah, in fact they've launched a password manager app. https://lockwise.firefox.com/ https://lockwise.firefox.com/