6 ms·
To counter this: if you happen to find yourself on the phishing domain facebo0k.com and you end up copying your password into that.. Browser extensions guard fo
by askmike 6y ago
To counter this: if you happen to find yourself on the phishing domain facebo0k.com and you end up copying your password into that.. Browser extensions guard for this better than we can.
- flemhans 6y agoYes, password managers are way safer than copy-pasting. You don't want something as sensitive as a password in your clipboard buffer, either.
- kgwxd 6y agoMine clears the clipboard after 10 seconds.
- deleted 6y ago[deleted]
- ProtoAES256 6y agoYou do realize that in 10 seconds your computer can achieve a lot of stuffs right?
- treesprite82 6y agoI don't think a webpage can read clipboard without the user manually pasting. If there's some malicious desktop program running on your machine at the same time as the password manager then you're probably screwed regardless of whether the password passes through the clipboard - but maybe there's some subtleties I'm missing here.
- flemhans 6y agoI've accidentally pasted sensitive passwords enough times that I know the procedure is prone to errors. If I have to do it, I immediately copy something else right afterwards, to avoid an accidental paste later on.
- treesprite82 6y ago10 seconds auto-clear (which is configurable) is short enough to prevent me accidentally pasting onto some other site. Could be better if it auto-cleared after a paste, but not sure how feasible that would be.
- fsh 6y agoFor example it could just read all the passwords from the password manager's UI.
- pyhtel 6y agoBetween Keepass, 1passwword, and lastpass I've never seen a password manager that just shows the password without the user explicitly choosing to reveal it
- EricE 6y ago1password has the option to do so and I do it on my home desktop computer. Obviously on mobile devices it would be a bad idea and on those I leave that option in it's default, disabled state :)
- julienreszka 6y agoLol
- abdullahkhalids 6y agoThe purpose of clearing clipboard is so you don't accidentally paste it into a chat window or something. Not to protect against malicious programs.
- reilly3000 6y agoGah what then? I use strong passwords but almost all of them flow through my clipboard.
- jhanschoo 6y agoI a simple algorithm to generate a password based on the name of the service you are using, interleaved with a constant master password you remember. You can do the same thing with a password-manager password + clipboard, interleaved with a constant master password you remember, which should be even better.
- 3np 6y agoThere are non-browser-extension password managers that still emulate you typing on your keyboard, rather than going through clipboard. Personally I use rofi-pass to access GNU pass passwords (so just a hotkey and search for password name) I'd warmly recommend it (or whatever other client you use for GNU pass) but I'm sure you can find similar functionality for any other decent password manager.
- abdullahkhalids 6y agoSome password managers will type the username/password into the browser (through a virtual keyboard I think), not copy-paste them to protect against clipboard attacks. Eg. Keepasssc
- deleted 6y ago[deleted]
- mPReDiToR 6y agoFirefox extension, Passhash NG. Makes them easy to use, with no saved PW.
- Saris 6y agoI used to use Keepass with auto-type. I had a hotkey for it, and it would recognize the site based on the browser window title. That would probably be the best of both, no clipboard, and no browser addons.
- deleted 6y ago[deleted]
- bfdm 6y agoMaybe we should take the best of both worlds then: an extension that only knows which domains you have passwords saved for, but not the account or PW. It just serves as a red flag if the domain is suspect.
- paulryanrogers 6y agoThis is how the Keepass Helper extension has worked for years: putting the domain in the RHS of the titlebar. Then with autotype set to match that you can autotype from the global hotkey. Keepass 2 can even split the credentials between key presses and pasting. There are other URL in title extensions for most browsers. And they're simple enough you can audit them or write your own.