8 ms·

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near your web browser just seems like insanity to me (all the exploit write-ups I recall about password managers were related to browser extensions and sandbox escapes). This seems like another reason. It's not worth it. Keep the password manager in its own app and apply the tiny extra effort of pasting the password from there.

walrus01 6y ago
this is why I use a password manager that has no network connectivity whatsoever, and no browser integration. keepassx with a v2.0 keepass format file. it works from a local file on disk. yes, it's more inconvenient if I am away from the computer it lives on, and I need to update a password, I have to connect the VPN to my home office, ssh to it, and run 'kpcli' (a keepass format command line program), or run keepassx in a vnc-over-ssh session. but that hassle is worth it in my opinion.
askmike 6y ago
To counter this: if you happen to find yourself on the phishing domain facebo0k.com and you end up copying your password into that.. Browser extensions guard for this better than we can.
- flemhans 6y ago
  Yes, password managers are way safer than copy-pasting. You don't want something as sensitive as a password in your clipboard buffer, either.
  - kgwxd 6y ago
    Mine clears the clipboard after 10 seconds.
    - deleted 6y ago
      [deleted]
    - ProtoAES256 6y ago
      You do realize that in 10 seconds your computer can achieve a lot of stuffs right?
      - treesprite82 6y ago
        I don't think a webpage can read clipboard without the user manually pasting. If there's some malicious desktop program running on your machine at the same time as the password manager then you're probably screwed regardless of whether the password passes through the clipboard - but maybe there's some subtleties I'm missing here.
        flemhans 6y ago
        I've accidentally pasted sensitive passwords enough times that I know the procedure is prone to errors. If I have to do it, I immediately copy something else right afterwards, to avoid an accidental paste later on.
        treesprite82 6y ago
        10 seconds auto-clear (which is configurable) is short enough to prevent me accidentally pasting onto some other site. Could be better if it auto-cleared after a paste, but not sure how feasible that would be.
      - fsh 6y ago
        For example it could just read all the passwords from the password manager's UI.
        pyhtel 6y ago
        Between Keepass, 1passwword, and lastpass I've never seen a password manager that just shows the password without the user explicitly choosing to reveal it
  - reilly3000 6y ago
    Gah what then? I use strong passwords but almost all of them flow through my clipboard.
    - jhanschoo 6y ago
      I a simple algorithm to generate a password based on the name of the service you are using, interleaved with a constant master password you remember. You can do the same thing with a password-manager password + clipboard, interleaved with a constant master password you remember, which should be even better.
    - 3np 6y ago
      There are non-browser-extension password managers that still emulate you typing on your keyboard, rather than going through clipboard. Personally I use rofi-pass to access GNU pass passwords (so just a hotkey and search for password name) I'd warmly recommend it (or whatever other client you use for GNU pass) but I'm sure you can find similar functionality for any other decent password manager.
    - abdullahkhalids 6y ago
      Some password managers will type the username/password into the browser (through a virtual keyboard I think), not copy-paste them to protect against clipboard attacks. Eg. Keepasssc
      - deleted 6y ago
        [deleted]
    - mPReDiToR 6y ago
      Firefox extension, Passhash NG. Makes them easy to use, with no saved PW.
    - Saris 6y ago
      I used to use Keepass with auto-type. I had a hotkey for it, and it would recognize the site based on the browser window title. That would probably be the best of both, no clipboard, and no browser addons.
- deleted 6y ago
  [deleted]
- bfdm 6y ago
  Maybe we should take the best of both worlds then: an extension that only knows which domains you have passwords saved for, but not the account or PW. It just serves as a red flag if the domain is suspect.
  - paulryanrogers 6y ago
    This is how the Keepass Helper extension has worked for years: putting the domain in the RHS of the titlebar. Then with autotype set to match that you can autotype from the global hotkey. Keepass 2 can even split the credentials between key presses and pasting. There are other URL in title extensions for most browsers. And they're simple enough you can audit them or write your own.
hombre_fatal 6y ago
Password managers aren't nearly intelligent enough to be used without copy and paste for sensitive forms. One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. So imagine a form like this: Amount to transfer: <input type="number"> From account ID: <input type="text"> Confirm password: <input type="password"> <button type="submit">Submit</button> I found that there's no good hackless way to allow a password manager to autofill the password without touching the other fields with a username or some other quirk like just clearing your inputs. Even a fix like opening a modal with the lone password confirmation field doesn't necessarily fix it in all browser/OS configurations. Password managers are braindead and browsers don't give you any tools to help.
- DangitBobby 6y ago
  I find that both Bitwarden (personal use) and 1password (work use) do a very good job of filling in login forms.
  - hombre_fatal 6y ago
    1Password was one of my test extensions and the one I use every day. It works most of the time because username/password combos are the most common autofill configurations. So common that most password managers don't consider the case where you want to autofill a password without a matching username field on the page. "Password confirmation" being the classic example. They just don't handle anything other than the main case very well.
    - DangitBobby 6y ago
      Interesting. The weirdest site I use on a regular basis is Mailgun and it has this scrolling form which isolates entry for email/password/2fa (which, as an aside, I hate) and it gets it right every time. I can't remember any instances of it going wrong, actually.
SPBS 6y ago
I've never encountered any autofill instance where the effects of autofill wasn't immediately apparent (usually it's just the username and password). Having a special hidden fields in your form seems like a Bad Idea, but what is worrying is that there is nothing stopping more devs from implementing something like this. The only reason why we don't see it more often is probably because it takes more effort to make a "smart" form like this.
ramraj07 6y ago
After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!
- MontagFTB 6y ago
  Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?
  - JohnTHaller 6y ago
    On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.
    - edoceo 6y ago
      That's paste
      - sjs382 6y ago
        It looks like paste and it's almost the same from the user perspective, but the data never makes it to the clipboard, where it would be available to every running application.
        shakna 6y ago
        From what I can see, KeePass does use the clipboard. [0] [0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/Native/ClipboardU.cs https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/N...
        sjs382 6y ago
chillfox 6y ago
There is no way I could have convinced the people I have to use a password manager without the browser extension. So for those people it was either same password on all sites or a password manager with a browser extension.
neya 6y ago
I use Firefox's own password manager (https://www.mozilla.org/en-US/firefox/lockwise/ https://www.mozilla.org/en-US/firefox/lockwise/) inbuilt into the browser. I think it's a better compromise than having to expose sensitive credentials into my clipboard. IT works across devices too, so there's no copy pasting on my Android device which god forbid is probably reading my clipboard too (I know Facebook used to do that). I do not see a reason to copy paste in any use case at all.
pitkali 6y ago
I just have autofill disabled. To fill in the password, I need to actually click some buttons.

walrus01 6y ago

this is why I use a password manager that has no network connectivity whatsoever, and no browser integration. keepassx with a v2.0 keepass format file. it works from a local file on disk. yes, it's more inconvenient if I am away from the computer it lives on, and I need to update a password, I have to connect the VPN to my home office, ssh to it, and run 'kpcli' (a keepass format command line program), or run keepassx in a vnc-over-ssh session. but that hassle is worth it in my opinion.

askmike 6y ago

To counter this: if you happen to find yourself on the phishing domain facebo0k.com and you end up copying your password into that.. Browser extensions guard for this better than we can.

flemhans 6y ago
Yes, password managers are way safer than copy-pasting. You don't want something as sensitive as a password in your clipboard buffer, either.
- kgwxd 6y ago
  Mine clears the clipboard after 10 seconds.
  - deleted 6y ago
    [deleted]
  - ProtoAES256 6y ago
    You do realize that in 10 seconds your computer can achieve a lot of stuffs right?
    - treesprite82 6y ago
      I don't think a webpage can read clipboard without the user manually pasting. If there's some malicious desktop program running on your machine at the same time as the password manager then you're probably screwed regardless of whether the password passes through the clipboard - but maybe there's some subtleties I'm missing here.
      - flemhans 6y ago
        I've accidentally pasted sensitive passwords enough times that I know the procedure is prone to errors. If I have to do it, I immediately copy something else right afterwards, to avoid an accidental paste later on.
        treesprite82 6y ago
        10 seconds auto-clear (which is configurable) is short enough to prevent me accidentally pasting onto some other site. Could be better if it auto-cleared after a paste, but not sure how feasible that would be.
    - fsh 6y ago
      For example it could just read all the passwords from the password manager's UI.
      - pyhtel 6y ago
        Between Keepass, 1passwword, and lastpass I've never seen a password manager that just shows the password without the user explicitly choosing to reveal it
- reilly3000 6y ago
  Gah what then? I use strong passwords but almost all of them flow through my clipboard.
  - jhanschoo 6y ago
    I a simple algorithm to generate a password based on the name of the service you are using, interleaved with a constant master password you remember. You can do the same thing with a password-manager password + clipboard, interleaved with a constant master password you remember, which should be even better.
  - 3np 6y ago
    There are non-browser-extension password managers that still emulate you typing on your keyboard, rather than going through clipboard. Personally I use rofi-pass to access GNU pass passwords (so just a hotkey and search for password name) I'd warmly recommend it (or whatever other client you use for GNU pass) but I'm sure you can find similar functionality for any other decent password manager.
  - abdullahkhalids 6y ago
    Some password managers will type the username/password into the browser (through a virtual keyboard I think), not copy-paste them to protect against clipboard attacks. Eg. Keepasssc
    - deleted 6y ago
      [deleted]
  - mPReDiToR 6y ago
    Firefox extension, Passhash NG. Makes them easy to use, with no saved PW.
  - Saris 6y ago
    I used to use Keepass with auto-type. I had a hotkey for it, and it would recognize the site based on the browser window title. That would probably be the best of both, no clipboard, and no browser addons.
deleted 6y ago
[deleted]
bfdm 6y ago
Maybe we should take the best of both worlds then: an extension that only knows which domains you have passwords saved for, but not the account or PW. It just serves as a red flag if the domain is suspect.
- paulryanrogers 6y ago
  This is how the Keepass Helper extension has worked for years: putting the domain in the RHS of the titlebar. Then with autotype set to match that you can autotype from the global hotkey. Keepass 2 can even split the credentials between key presses and pasting. There are other URL in title extensions for most browsers. And they're simple enough you can audit them or write your own.

hombre_fatal 6y ago

Password managers aren't nearly intelligent enough to be used without copy and paste for sensitive forms. One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. So imagine a form like this: Amount to transfer: <input type="number"> From account ID: <input type="text"> Confirm password: <input type="password"> <button type="submit">Submit</button> I found that there's no good hackless way to allow a password manager to autofill the password without touching the other fields with a username or some other quirk like just clearing your inputs. Even a fix like opening a modal with the lone password confirmation field doesn't necessarily fix it in all browser/OS configurations. Password managers are braindead and browsers don't give you any tools to help.

DangitBobby 6y ago
I find that both Bitwarden (personal use) and 1password (work use) do a very good job of filling in login forms.
- hombre_fatal 6y ago
  1Password was one of my test extensions and the one I use every day. It works most of the time because username/password combos are the most common autofill configurations. So common that most password managers don't consider the case where you want to autofill a password without a matching username field on the page. "Password confirmation" being the classic example. They just don't handle anything other than the main case very well.
  - DangitBobby 6y ago
    Interesting. The weirdest site I use on a regular basis is Mailgun and it has this scrolling form which isolates entry for email/password/2fa (which, as an aside, I hate) and it gets it right every time. I can't remember any instances of it going wrong, actually.

SPBS 6y ago

I've never encountered any autofill instance where the effects of autofill wasn't immediately apparent (usually it's just the username and password). Having a special hidden fields in your form seems like a Bad Idea, but what is worrying is that there is nothing stopping more devs from implementing something like this. The only reason why we don't see it more often is probably because it takes more effort to make a "smart" form like this.

ramraj07 6y ago

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!

MontagFTB 6y ago
Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?
- JohnTHaller 6y ago
  On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.
  - edoceo 6y ago
    That's paste
    - sjs382 6y ago
      It looks like paste and it's almost the same from the user perspective, but the data never makes it to the clipboard, where it would be available to every running application.
      - shakna 6y ago
        From what I can see, KeePass does use the clipboard. [0] [0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/Native/ClipboardU.cs https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/N...
        sjs382 6y ago

chillfox 6y ago

There is no way I could have convinced the people I have to use a password manager without the browser extension. So for those people it was either same password on all sites or a password manager with a browser extension.

neya 6y ago

I use Firefox's own password manager (https://www.mozilla.org/en-US/firefox/lockwise/ https://www.mozilla.org/en-US/firefox/lockwise/) inbuilt into the browser. I think it's a better compromise than having to expose sensitive credentials into my clipboard. IT works across devices too, so there's no copy pasting on my Android device which god forbid is probably reading my clipboard too (I know Facebook used to do that). I do not see a reason to copy paste in any use case at all.

pitkali 6y ago

I just have autofill disabled. To fill in the password, I need to actually click some buttons.