4 ms·

A very nice addition to i3 is pass, the paswordmanager which comes with passmenu that lets you read and autotype passwords with dmenu.

eurasiantiger 5y ago
I never, ever use these autotyping features; they are a security risk. Is my paranoia justified?
- eloeffler 5y ago
  As far as I can assess this, I believe it is safer to do this instead of copying to the clipboard. The clipboard might be read by a malicious process while autotype with passmeni will only pipe the password to xdotool and that will generate keystrokes. it's only important to have the correct field selected before autotyping or you might end up googling your password :)
  - eurasiantiger 5y ago
    A malicious process could also do many other things. I think the most likely vector for autotyping attacks is simple phishing / clickjacking.
    - Normal_gaussian 5y ago
      For general readers: Its pretty safe when done via a browser plugin to a website because the plugin both verifies the website (anti-phishing) and uses auto-fill rather than type (it directly injects into the target field rather than typing, so clickjacking isn't a risk). Its rare that I use passwords outside of the browser now, but windows and mac allow system credentials to mitigate the same risks for desktop apps (the app must support it).
    - eloeffler 5y ago
      True, but wouldn't that apply to manual password entry as much?
- hyperstar 5y ago
  I don't think so. https://security.stackexchange.com/a/171916/257701 https://security.stackexchange.com/a/171916/257701
  - megous 5y ago
    The link says you should not use the autotype, but use the browser password manager instead.
- captn3m0 5y ago
  I use both browserpass, and pass and consider the pass+dmenu model to be more secure. I keep auto-fill disabled on the browserpass extension, and recommend doing the same for any password manager. Mainly because bugs in browser extensions have led to easily exploitable bugs where the extension could be tricked into thinking it was filling the password for google.com, while the page wasn't actually google.com (dubbed Auto-fill sweep attacks on pg25 at https://aaltodoc.aalto.fi/bitstream/handle/123456789/27984/master_Manihatty_Bojan_Viswanathan_2017.pdf https://aaltodoc.aalto.fi/bitstream/handle/123456789/27984/m...)

eurasiantiger 5y ago

I never, ever use these autotyping features; they are a security risk. Is my paranoia justified?

eloeffler 5y ago
As far as I can assess this, I believe it is safer to do this instead of copying to the clipboard. The clipboard might be read by a malicious process while autotype with passmeni will only pipe the password to xdotool and that will generate keystrokes. it's only important to have the correct field selected before autotyping or you might end up googling your password :)
- eurasiantiger 5y ago
  A malicious process could also do many other things. I think the most likely vector for autotyping attacks is simple phishing / clickjacking.
  - Normal_gaussian 5y ago
    For general readers: Its pretty safe when done via a browser plugin to a website because the plugin both verifies the website (anti-phishing) and uses auto-fill rather than type (it directly injects into the target field rather than typing, so clickjacking isn't a risk). Its rare that I use passwords outside of the browser now, but windows and mac allow system credentials to mitigate the same risks for desktop apps (the app must support it).
  - eloeffler 5y ago
    True, but wouldn't that apply to manual password entry as much?
hyperstar 5y ago
I don't think so. https://security.stackexchange.com/a/171916/257701 https://security.stackexchange.com/a/171916/257701
- megous 5y ago
  The link says you should not use the autotype, but use the browser password manager instead.
captn3m0 5y ago
I use both browserpass, and pass and consider the pass+dmenu model to be more secure. I keep auto-fill disabled on the browserpass extension, and recommend doing the same for any password manager. Mainly because bugs in browser extensions have led to easily exploitable bugs where the extension could be tricked into thinking it was filling the password for google.com, while the page wasn't actually google.com (dubbed Auto-fill sweep attacks on pg25 at https://aaltodoc.aalto.fi/bitstream/handle/123456789/27984/master_Manihatty_Bojan_Viswanathan_2017.pdf https://aaltodoc.aalto.fi/bitstream/handle/123456789/27984/m...)