5 ms·

Fishy! This site requests access to all passwords in my KeePassXC Firefox addon. Never seen quite that level of blatancy before.

kmlx 7y ago
wow. is this even legal?
interfixus 7y ago
It does, dammit! Downvoter care to elaborate?
- segfaultbuserr 7y ago
  Use https://archive.fo/w7Uoq https://archive.fo/w7Uoq
- StreamBright 7y ago
  You have been experiencing the downvote culture that developed recently on HN.
- mtmail 7y ago
  What a Firefox plugin does on a computer has little to do with "How UK security services neutralised the Guardian newspaper" and distracts the discussion. It get boring reading about popups, font-choices, a website not working in Opera 9, auto-playing videos, paywalls. What I've witnessed (I didn't downvote) is as soon as such off-article-topic goes to 5+ comments or half the comment thread it gets downvoted.
- quickthrower2 7y ago
  Not a down-voter myself, but the statement made needs more elaboration, because at first glance it makes it sound like there is a security issue with the site, when it is more likely to be an issue with the password manager.
- Tomte 7y ago
  No, it doesn't. Because web sites aren't involved in how your password managers works. Best guess: the password manager cannot match the title or URL to any of your password entries and now offers you to pick the right one. Screaming murder doesn't make your comments any more credible or valuable.
k1m 7y ago
Can you elaborate? How does it do that? And why would that level of access, even if a website wanted it, even be a feature of a password manager? Genuinely curious.
- interfixus 7y ago
  You're right, I should elaborate. The site causes a normal KeePassXC-Browser popup, "www.dailymaverick.co.za has requested access to passwords for the following item(s). Please select whether you want to allow access." Then comes the weird stuff. It may not actually be all my passwords, but it sure is a lot of them, the long list ominously beginning with my bank and a mobile payment solutions. It's probably a bug of some kind. But sure looks scary. On my way to work, and on phone only for next many hours, so not able to look further into.
  - ctack 7y ago
    Please do. The editorial staff seem like a really well intentioned bunch, but of course there could be something nefarious going on.
    - goldcd 7y ago
      Or it could all be FUD, spread by MI6 raises eyebrow
  - k1m 7y ago
    Thanks. If I had to guess, I'd say this sounds more like a problem with KeePassXC than the site. I haven't used KeePassXC, but in my experience of these kind of addons, the site is not even involved in making a request for a password, the password manager kicks in when it detects a login prompt and suggest a password based on the URL of the site you've loaded. That's why I was curious how it would be possible for the site to not only initiate this, but demand passwords for other sites.
elp 7y ago
Its their dodgy ad network as always. Daily Maverick is great journalism by South African standards but they are complete and utter idiots when it comes to their advertisers. Then they wonder why everyone blocks ads and they can't make money.

kmlx 7y ago

wow. is this even legal?

interfixus 7y ago

It does, dammit! Downvoter care to elaborate?

segfaultbuserr 7y ago
Use https://archive.fo/w7Uoq https://archive.fo/w7Uoq
StreamBright 7y ago
You have been experiencing the downvote culture that developed recently on HN.
mtmail 7y ago
What a Firefox plugin does on a computer has little to do with "How UK security services neutralised the Guardian newspaper" and distracts the discussion. It get boring reading about popups, font-choices, a website not working in Opera 9, auto-playing videos, paywalls. What I've witnessed (I didn't downvote) is as soon as such off-article-topic goes to 5+ comments or half the comment thread it gets downvoted.
quickthrower2 7y ago
Not a down-voter myself, but the statement made needs more elaboration, because at first glance it makes it sound like there is a security issue with the site, when it is more likely to be an issue with the password manager.
Tomte 7y ago
No, it doesn't. Because web sites aren't involved in how your password managers works. Best guess: the password manager cannot match the title or URL to any of your password entries and now offers you to pick the right one. Screaming murder doesn't make your comments any more credible or valuable.

k1m 7y ago

Can you elaborate? How does it do that? And why would that level of access, even if a website wanted it, even be a feature of a password manager? Genuinely curious.

interfixus 7y ago
You're right, I should elaborate. The site causes a normal KeePassXC-Browser popup, "www.dailymaverick.co.za has requested access to passwords for the following item(s). Please select whether you want to allow access." Then comes the weird stuff. It may not actually be all my passwords, but it sure is a lot of them, the long list ominously beginning with my bank and a mobile payment solutions. It's probably a bug of some kind. But sure looks scary. On my way to work, and on phone only for next many hours, so not able to look further into.
- ctack 7y ago
  Please do. The editorial staff seem like a really well intentioned bunch, but of course there could be something nefarious going on.
  - goldcd 7y ago
    Or it could all be FUD, spread by MI6 raises eyebrow
- k1m 7y ago
  Thanks. If I had to guess, I'd say this sounds more like a problem with KeePassXC than the site. I haven't used KeePassXC, but in my experience of these kind of addons, the site is not even involved in making a request for a password, the password manager kicks in when it detects a login prompt and suggest a password based on the URL of the site you've loaded. That's why I was curious how it would be possible for the site to not only initiate this, but demand passwords for other sites.

elp 7y ago

Its their dodgy ad network as always. Daily Maverick is great journalism by South African standards but they are complete and utter idiots when it comes to their advertisers. Then they wonder why everyone blocks ads and they can't make money.