4 ms·

The point is that while yes, many 3rd party password managers have issues, the overwhelming majority of attacks are not against password managers but against re

by 542458 5y ago

The point is that while yes, many 3rd party password managers have issues, the overwhelming majority of attacks are not against password managers but against reused passwords - so honestly either the 1st or 3rd party choice is a win over using neither.

H8crilA 5y ago
Ok so: 1) not use any manager => bad 2) use a 3rd party => pretty crap as the article says 3) use a built-in => great Why would you ever use 2? This is almost as bad as Bitcoin, which not only solves nothing but also destroys a ton of energy. I have never used a manager except for the builtins. And I would have never expected them (prior to reading this article) to be such utterly junk solutions to just inject additional code into the website itself. I thought there's a dedicated browser API or something.
- kennywinker 5y ago
  3rd party password managers have a bunch of useful features, which is why I use one. Here are the first few that come to mind: - portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck. - built-in password managers only work for websites - I store many non-website security credentials in my password manager - extra details - I often add the security questions for a site into my password manager - compromised password warnings (maybe some of the built in password systems do this now?)
  - H8crilA 5y ago
    2, 3, 4 are handled by Chrome, for example. These really are trivial features that any decent corpo can get right. 1 obviously isn't.
    - kennywinker 5y ago
      Oh, yes, I forgot a pretty important one, I don't want to upload all my passwords to google. Offline storage, and direct device-to-device syncing.
    - lazide 5y ago
      Last I checked I couldn’t export Chrome passwords (aka offline backup), couldn’t add non site passwords, and couldn’t manage non site based passwords/secrets with chrome password manager. And that was a month ago?
      - riffraff 5y ago
        You can import chrome passwords from other browsers so I think you can also export them for backup. I agree that I don't think you can add custom secrets.
        lazide 5y ago
        Sure enough, looks like I was wrong re: export. Thanks! Unfortunately other things are still an issue - https://support.google.com/chrome/answer/95606 https://support.google.com/chrome/answer/95606
  - deleted 5y ago
    [deleted]
  - squiggleblaz 5y ago
    > - built-in password managers only work for websites - I store many non-website security credentials in my password manager The one integrated with Firefox supports integration with an Android stored password entry tool. As a manager it's of very poor quality - better to do all your actual management from desktop Firefox - but as a tool to enter a stored password into an app, or to save the password you just entered, it works quite nicely. > - compromised password warnings (maybe some of the built in password systems do this now?) Firefox does have that service
gruez 5y ago
That's only because there are more people who reuse passwords than people who use online password managers. As they're becoming popular, more cybercriminals are going to exploit it.
- shawnz 5y ago
  But also there will also be more attention directed toward these low-hanging vulnerabilities, so perhaps password manager vendors will adapt too.
- laumars 5y ago
  There are already enough people using password managers that they’re a target. If they were as easy targets as you imply, then they’d already be exploited. The fact they’re not demonstrates that’s reused passwords is lower hanging fruit.
- dogma1138 5y ago
  Attacking password managers is still a scalability problem, there would be always better targets out there to gain access to credentials. Sure if you are in a position that your threat model includes actual targeted attacks then you need to reconsider things. But then software password managers might not be the way to go regardless. A lot of security advice needs to be taken in the context it was given - that context is always a specific threat model(s). Writing down passwords in an office is a terrible idea, keeping a small book with passwords in a drawer in your study is quite fine for most people. Security is always a trade off between different threat models, anything you do reduces the likelihood of ones and increase the likelihood of others. Encrypting the laptop reduces the chance of some random person extracting data if the device is lost or stolen, also to some extent reduces the chances of it being successfully searched by law enforcement. It does however increases the chances of a threat agent torturing you or your loved ones for access. Now this isn’t an argument to not use device encryption, unless ofc the threat of violence is actually real at that point neither option might actually be viable and you would look for other means to store and transport data other than an encrypted device.

by 542458 5y ago

H8crilA 5y ago

Ok so: 1) not use any manager => bad 2) use a 3rd party => pretty crap as the article says 3) use a built-in => great Why would you ever use 2? This is almost as bad as Bitcoin, which not only solves nothing but also destroys a ton of energy. I have never used a manager except for the builtins. And I would have never expected them (prior to reading this article) to be such utterly junk solutions to just inject additional code into the website itself. I thought there's a dedicated browser API or something.

kennywinker 5y ago
3rd party password managers have a bunch of useful features, which is why I use one. Here are the first few that come to mind: - portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck. - built-in password managers only work for websites - I store many non-website security credentials in my password manager - extra details - I often add the security questions for a site into my password manager - compromised password warnings (maybe some of the built in password systems do this now?)
- H8crilA 5y ago
  2, 3, 4 are handled by Chrome, for example. These really are trivial features that any decent corpo can get right. 1 obviously isn't.
  - kennywinker 5y ago
    Oh, yes, I forgot a pretty important one, I don't want to upload all my passwords to google. Offline storage, and direct device-to-device syncing.
  - lazide 5y ago
    Last I checked I couldn’t export Chrome passwords (aka offline backup), couldn’t add non site passwords, and couldn’t manage non site based passwords/secrets with chrome password manager. And that was a month ago?
    - riffraff 5y ago
      You can import chrome passwords from other browsers so I think you can also export them for backup. I agree that I don't think you can add custom secrets.
      - lazide 5y ago
        Sure enough, looks like I was wrong re: export. Thanks! Unfortunately other things are still an issue - https://support.google.com/chrome/answer/95606 https://support.google.com/chrome/answer/95606
- deleted 5y ago
  [deleted]
- squiggleblaz 5y ago
  > - built-in password managers only work for websites - I store many non-website security credentials in my password manager The one integrated with Firefox supports integration with an Android stored password entry tool. As a manager it's of very poor quality - better to do all your actual management from desktop Firefox - but as a tool to enter a stored password into an app, or to save the password you just entered, it works quite nicely. > - compromised password warnings (maybe some of the built in password systems do this now?) Firefox does have that service

gruez 5y ago

That's only because there are more people who reuse passwords than people who use online password managers. As they're becoming popular, more cybercriminals are going to exploit it.

shawnz 5y ago
But also there will also be more attention directed toward these low-hanging vulnerabilities, so perhaps password manager vendors will adapt too.
laumars 5y ago
There are already enough people using password managers that they’re a target. If they were as easy targets as you imply, then they’d already be exploited. The fact they’re not demonstrates that’s reused passwords is lower hanging fruit.
dogma1138 5y ago
Attacking password managers is still a scalability problem, there would be always better targets out there to gain access to credentials. Sure if you are in a position that your threat model includes actual targeted attacks then you need to reconsider things. But then software password managers might not be the way to go regardless. A lot of security advice needs to be taken in the context it was given - that context is always a specific threat model(s). Writing down passwords in an office is a terrible idea, keeping a small book with passwords in a drawer in your study is quite fine for most people. Security is always a trade off between different threat models, anything you do reduces the likelihood of ones and increase the likelihood of others. Encrypting the laptop reduces the chance of some random person extracting data if the device is lost or stolen, also to some extent reduces the chances of it being successfully searched by law enforcement. It does however increases the chances of a threat agent torturing you or your loved ones for access. Now this isn’t an argument to not use device encryption, unless ofc the threat of violence is actually real at that point neither option might actually be viable and you would look for other means to store and transport data other than an encrypted device.