5 ms·
I disagree. The default for a password manager should be the most secure, with additional features and behavior only being enabled after the user has had at lea
by zeeZ 6y ago
I disagree. The default for a password manager should be the most secure, with additional features and behavior only being enabled after the user has had at least the chance to make an informed decision.
- geofft 6y agoThe most secure is not the most restrictive. A password manager extension has to work. If it doesn't work reliably and people end up copying/pasting passwords, that's not the "most secure".
- andrewnicolalde 6y ago> If it doesn't work reliably and people end up copying/pasting passwords, that's not the "most secure". Why not?
- geofft 6y agoBecause one of the security functions of a browser extension (as demonstrated by this very issue) is to ensure that a password for one site only goes to the same site, and not to a convincing-to-a-human phishing site. A browser extension that you can rely on to fill in your password is therefore better for your security than one where you get in the habit of deciding you know better than it and end up copying and pasting passwords and making judgments yourself.
- fomine3 6y agoInput just only for specified (registered) domain name is good for security. If you often use copy and paste, you may not notice you're inputting on phishing site that uses different domain name.
- zeeZ 6y agoSure, it should work reliably, but it also shouldn't have unexpected dangerous behavior like OP's complaint that the average user is not aware of. It could ship with good defaults and at some point, during setup, some introduction or when relevant conditions are met, ask the user if they want to enable that feature/behavior while giving more information about what it does and potential weaknesses. It doesn't have to be disabled forever or hidden behind some obscure feature flag.