5 ms·

So we are really getting passwords from remote hosted websites? Are people really about to copy, paste and use these right out of the browser?

daveoc64 6y ago
What is the risk exactly? Even if the site knew for certain that you had used one of the passwords, they would have no idea where you used the password, and they wouldn't know your username or other credentials. They might not even have any way of accessing the system you're putting the password into. I'm sure a lot of people will use these sorts of sites to generate a whole bunch of passwords, and not even use any of them.
- asdkhadsj 6y ago
  I'd imagine the risk is pretty great, for the same reason I wouldn't paste a password here that I use. Sure, you may not know who I am, but if you were the site itself you get a ton of information on me.. which is more than I'd like you to know if you _also_ know one of my passwords. I agree, the risk is minimal. Nevertheless.. security, heh.
  - mlyle 6y ago
    The site doesn't know the password, though-- it's generated clientside.
    - beardedwizard 6y ago
      Will you be inspecting the code every single time it loads to ensure that has not changed? You are receiving this code from an untrusted 3rd party every time you visit. There is a big difference to trusting a known entity like lastpass, 1password, etc, all of whom are vulnerable to supply chain attacks. It is another thing entirely to trust a random website on hackernews. Payload decoders and password generators are some of the biggest honeypots out there. Combining this with an attack taking advantage of hidden form autofill, you could gain quite a bit of information to go along with that password.
      - mlyle 6y ago
        If I were to use it, I'd probably just pull my own copy off github. If I were to recommend novices to use it-- I'd tell them to use a password manager locally, and something like that to generate a secure password to get into their own machine locally / get into their password manager-- which mitigates most of the risk if it turns rogue.
        beardedwizard 6y ago
        well then you wouldn't be using this or any other website, and this entire conversation would be moot :).

daveoc64 6y ago

What is the risk exactly? Even if the site knew for certain that you had used one of the passwords, they would have no idea where you used the password, and they wouldn't know your username or other credentials. They might not even have any way of accessing the system you're putting the password into. I'm sure a lot of people will use these sorts of sites to generate a whole bunch of passwords, and not even use any of them.

asdkhadsj 6y ago
I'd imagine the risk is pretty great, for the same reason I wouldn't paste a password here that I use. Sure, you may not know who I am, but if you were the site itself you get a ton of information on me.. which is more than I'd like you to know if you _also_ know one of my passwords. I agree, the risk is minimal. Nevertheless.. security, heh.
- mlyle 6y ago
  The site doesn't know the password, though-- it's generated clientside.
  - beardedwizard 6y ago
    Will you be inspecting the code every single time it loads to ensure that has not changed? You are receiving this code from an untrusted 3rd party every time you visit. There is a big difference to trusting a known entity like lastpass, 1password, etc, all of whom are vulnerable to supply chain attacks. It is another thing entirely to trust a random website on hackernews. Payload decoders and password generators are some of the biggest honeypots out there. Combining this with an attack taking advantage of hidden form autofill, you could gain quite a bit of information to go along with that password.
    - mlyle 6y ago
      If I were to use it, I'd probably just pull my own copy off github. If I were to recommend novices to use it-- I'd tell them to use a password manager locally, and something like that to generate a secure password to get into their own machine locally / get into their password manager-- which mitigates most of the risk if it turns rogue.
      - beardedwizard 6y ago
        well then you wouldn't be using this or any other website, and this entire conversation would be moot :).