6 ms·

So does this justify my use of a password manager with no browser integration, and all the microseconds of lost productivity due to copying and pasting password

So does this justify my use of a password manager with no browser integration, and all the microseconds of lost productivity due to copying and pasting passwords all the time?

neandrake 5y ago
For anyone looking for a personal password manager that is not a browser extension but also provides the functionality to auto-type passwords into the focused field I highly recommend codebook https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/ It's a one-time fee (per device~ish) and you can connect & sync it to Google Drive, Dropbox, Local folder, or to another device over WiFi. I've been using it for a few years and it has great iPhone and macOS integration. The Windows integration is also good but not quite as smooth as being integrated with FaceID or thumb print ID.
jayknight 5y ago
KeePass can emulate a keyboard and type your credentials for you. But it's initiated from the KeePass app instead of requesting it from the browser. It is slower than just having it autofilled but faster than copying it to your clipboard (where other programs might have access to it).
- loudtieblahblah 5y ago
  IMHO - keepass was way faster via keybinding than dragging your mouse to a browser plugin drop down.
  - jackson1442 5y ago
    Not sure what other managers you’ve used but with 1Password I just press cmd+shift+x to show a popover, arrow keys to choose the account, then press enter. No mouse needed.
- dotancohen 5y ago
  My muscle memory copies the URL from the browser into the Keepass search bar. Thus, I get more-or-less protection from rogue URLs as well - and I'm forced to look at the URL with my eyeballs.
UI_at_80x24 5y ago
Yes, but a much better argument against doing that: If you keep your passwords separate from your browser then you are guaranteed to be safe from a browser exploit.
kam 5y ago
Pasting a password into a phishing site because you don't have the browser checking the domain for you seems like a bigger risk than being exploited by something like this.
- ziml77 5y ago
  Agreed. The only time I nearly lost an account to phishing it was because I manually copy-pasted my credentials. It's an easy mistake to make, especially if you happen to be tired or distracted.
- marbu 5y ago
  Good mitigation of that would be for a password manager to store an url along with password.
  - K5EiS 5y ago
    That is usually what password managers do.
  - Biganon 5y ago
    Parent comment was precisely using this as a pro for in-browser password managers (or extensions). They can check the current domain. A standalone desktop app can't do that (well it can, but it's a bit more complicated to truly understand what tab you're currently looking at, and intend to use a password with)
    - marbu 5y ago
      To clarify: I suggested to store url in the password manager so that when I want to login somewhere, I go the the manager, locate the account, copy paste url stored there into url bar of the browser in a new tab, and then do the same with actual credentials. There is no room for any phishing in such case. That said I understand that when a password manager is closely integrated with (or even within) a browser, it can do more checking for me, and make the whole experience nicer. But such integration is imho not a silver bullet, and there are downsides which comes with this approach as well.
loudtieblahblah 5y ago
I used to use KeePassX (and KeePassXC) for over a decade and I know a lot of people hate it because it doesn't have online syncing and you have to go out of your way to use yet another app to get it to integrate into a browser. But one of the wonderful things it does over every other password manager is Auto-Fill based on a keybinding. It would look at the Window Title and find the available passwords that matched. This was infinitely more useful than most browser-plugins that look at URL within the browser. Because now I could have it fill out auth for Windows shares. If a website has a .htaccess User/Pass window - most browser plugins wont autofill this, but KeePassX(C) could. Terminal? I had all my SSH Passphrased and Sudo passwords in KeepassX(C) and could auto-fill on keybinding. It was wonderful. After failing to backup my database a few times and losing portions of newly added passwords I finally threw in the towel and went with Bitwarden. and bitwarden checks a lot of boxes - open source, you can self-host if you wish, third party audits, a good use of encryption, cross-platform both for browsers and desktop/mobile OSes. but man do i miss just autofilling with a keypress and not reaching for the mouse and autofilling in places outside of the browser. Anyways, I mention this b/c it's way better than manually copying/pasting. The Auto-fill would work by tossing it to the clipboard just long enough to do the auto-fill and then clearing the clipboard. So it was safer than manual copy/paste too.
- csnweb 5y ago
  At least in the bitwarden chrome extension you can autofill with a keyboard shortcut (and I assume in the ones for other browsers too). On mac os it defaults to CMD+shift+L. But that obviously doesn't work outside of the browser. Still might be interested for you.
  - hirvi74 5y ago
    I've had an awful time getting this to work consistently. Same with the prompting to add/update a new entry upon creating/changing a password.
- infogulch 5y ago
  > It would look at the Window Title and find the available passwords that matched. Ew that sounds awful for security and ripe for phishing. Nothing stops a site from setting the title to whatever they want, at least with a browser extension it only shows credentials when the domain matches, giving you a chance to second-guess it.
somehnacct3757 5y ago
I'm paranoid about putting a password into the clipboard. Some OS's keep a clipboard history or some users have software that does this. Another worry is that some app ecosystems provide a way to read my clipboard over their permission model. With this permission in hand, surveillance capitalists will include it as part of their fingerprinting techniques. So even if you trust those platforms, you also have to trust the packet headed their way and what they do with it.
- bee_rider 5y ago
  I think the only solution here is to not use an OS designed from the ground up by surveillance capitalists.
  - Rd6n6 5y ago
    That’s hard if your job depends on access to a windows only program like photoshop or a game engine (unity and unreal editors technically work on Linux, but it’s really painful)
- Fnoord 5y ago
  I was using Windows Terminal the other day and it does not copy text after selection. Ended up pasting a password instead...
- BenjiWiebe 5y ago
  With Linux/KDE desktop and KeePassXC, the password manager removes the copied text from the clipboard and the clipboard history after a short (configurable) delay.
BugsJustFindMe 5y ago
By default your computer and mobile phone OS and browsers likely let webpages and apps read your system clipboard without asking permission first.
- alanbernstein 5y ago
  Keepass can clear the clipboard after pasting.
- jonnycomputer 5y ago
  Most desktop/laptop browsers don't provide clipboard read access without asking permission first. Mobile is another thing tho.
outworlder 5y ago
Your clipboard has a huge attack surface.

So does this justify my use of a password manager with no browser integration, and all the microseconds of lost productivity due to copying and pasting passwords all the time?

neandrake 5y ago

For anyone looking for a personal password manager that is not a browser extension but also provides the functionality to auto-type passwords into the focused field I highly recommend codebook https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/ It's a one-time fee (per device~ish) and you can connect & sync it to Google Drive, Dropbox, Local folder, or to another device over WiFi. I've been using it for a few years and it has great iPhone and macOS integration. The Windows integration is also good but not quite as smooth as being integrated with FaceID or thumb print ID.

jayknight 5y ago

KeePass can emulate a keyboard and type your credentials for you. But it's initiated from the KeePass app instead of requesting it from the browser. It is slower than just having it autofilled but faster than copying it to your clipboard (where other programs might have access to it).

loudtieblahblah 5y ago
IMHO - keepass was way faster via keybinding than dragging your mouse to a browser plugin drop down.
- jackson1442 5y ago
  Not sure what other managers you’ve used but with 1Password I just press cmd+shift+x to show a popover, arrow keys to choose the account, then press enter. No mouse needed.
dotancohen 5y ago
My muscle memory copies the URL from the browser into the Keepass search bar. Thus, I get more-or-less protection from rogue URLs as well - and I'm forced to look at the URL with my eyeballs.

UI_at_80x24 5y ago

Yes, but a much better argument against doing that: If you keep your passwords separate from your browser then you are guaranteed to be safe from a browser exploit.

kam 5y ago

Pasting a password into a phishing site because you don't have the browser checking the domain for you seems like a bigger risk than being exploited by something like this.

ziml77 5y ago
Agreed. The only time I nearly lost an account to phishing it was because I manually copy-pasted my credentials. It's an easy mistake to make, especially if you happen to be tired or distracted.
marbu 5y ago
Good mitigation of that would be for a password manager to store an url along with password.
- K5EiS 5y ago
  That is usually what password managers do.
- Biganon 5y ago
  Parent comment was precisely using this as a pro for in-browser password managers (or extensions). They can check the current domain. A standalone desktop app can't do that (well it can, but it's a bit more complicated to truly understand what tab you're currently looking at, and intend to use a password with)
  - marbu 5y ago
    To clarify: I suggested to store url in the password manager so that when I want to login somewhere, I go the the manager, locate the account, copy paste url stored there into url bar of the browser in a new tab, and then do the same with actual credentials. There is no room for any phishing in such case. That said I understand that when a password manager is closely integrated with (or even within) a browser, it can do more checking for me, and make the whole experience nicer. But such integration is imho not a silver bullet, and there are downsides which comes with this approach as well.

loudtieblahblah 5y ago

I used to use KeePassX (and KeePassXC) for over a decade and I know a lot of people hate it because it doesn't have online syncing and you have to go out of your way to use yet another app to get it to integrate into a browser. But one of the wonderful things it does over every other password manager is Auto-Fill based on a keybinding. It would look at the Window Title and find the available passwords that matched. This was infinitely more useful than most browser-plugins that look at URL within the browser. Because now I could have it fill out auth for Windows shares. If a website has a .htaccess User/Pass window - most browser plugins wont autofill this, but KeePassX(C) could. Terminal? I had all my SSH Passphrased and Sudo passwords in KeepassX(C) and could auto-fill on keybinding. It was wonderful. After failing to backup my database a few times and losing portions of newly added passwords I finally threw in the towel and went with Bitwarden. and bitwarden checks a lot of boxes - open source, you can self-host if you wish, third party audits, a good use of encryption, cross-platform both for browsers and desktop/mobile OSes. but man do i miss just autofilling with a keypress and not reaching for the mouse and autofilling in places outside of the browser. Anyways, I mention this b/c it's way better than manually copying/pasting. The Auto-fill would work by tossing it to the clipboard just long enough to do the auto-fill and then clearing the clipboard. So it was safer than manual copy/paste too.

csnweb 5y ago
At least in the bitwarden chrome extension you can autofill with a keyboard shortcut (and I assume in the ones for other browsers too). On mac os it defaults to CMD+shift+L. But that obviously doesn't work outside of the browser. Still might be interested for you.
- hirvi74 5y ago
  I've had an awful time getting this to work consistently. Same with the prompting to add/update a new entry upon creating/changing a password.
infogulch 5y ago
> It would look at the Window Title and find the available passwords that matched. Ew that sounds awful for security and ripe for phishing. Nothing stops a site from setting the title to whatever they want, at least with a browser extension it only shows credentials when the domain matches, giving you a chance to second-guess it.

somehnacct3757 5y ago

I'm paranoid about putting a password into the clipboard. Some OS's keep a clipboard history or some users have software that does this. Another worry is that some app ecosystems provide a way to read my clipboard over their permission model. With this permission in hand, surveillance capitalists will include it as part of their fingerprinting techniques. So even if you trust those platforms, you also have to trust the packet headed their way and what they do with it.

bee_rider 5y ago
I think the only solution here is to not use an OS designed from the ground up by surveillance capitalists.
- Rd6n6 5y ago
  That’s hard if your job depends on access to a windows only program like photoshop or a game engine (unity and unreal editors technically work on Linux, but it’s really painful)
Fnoord 5y ago
I was using Windows Terminal the other day and it does not copy text after selection. Ended up pasting a password instead...
BenjiWiebe 5y ago
With Linux/KDE desktop and KeePassXC, the password manager removes the copied text from the clipboard and the clipboard history after a short (configurable) delay.

BugsJustFindMe 5y ago

By default your computer and mobile phone OS and browsers likely let webpages and apps read your system clipboard without asking permission first.

alanbernstein 5y ago
Keepass can clear the clipboard after pasting.
jonnycomputer 5y ago
Most desktop/laptop browsers don't provide clipboard read access without asking permission first. Mobile is another thing tho.

outworlder 5y ago

Your clipboard has a huge attack surface.