3 ms·
> It would look at the Window Title and find the available passwords that matched. Ew that sounds awful for security and ripe for phishing. Nothing stops a sit
by infogulch 5y ago
> It would look at the Window Title and find the available passwords that matched.
Ew that sounds awful for security and ripe for phishing. Nothing stops a site from setting the title to whatever they want, at least with a browser extension it only shows credentials when the domain matches, giving you a chance to second-guess it.
- stnmtn 5y agoSeriously, if I own faceboook.com and I just set my title to Facebook, this would copy in my facebook password? Sounds really really bad!
- orangepurple 5y agoI have used KeepassXC for almost a decade and never used that title matching feature. Control-U all the way
- infogulch 5y agoI think it's great that you use it in a way that protects you by always starting your workflow from your password manager and copying the URL into your browser. But I think it's important to recognize that 1. this requires extra steps, and 2. this represents a drastic change in workflow for the vast majority of users. Your solution will not work for most people.
- unethical_ban 5y agoIt doesn't automatically fill it in by landing on the page. It can detect how to autofill, and what password to use, based on window title. Your scenario still depends on the person landing on a phishing site and choosing to attempt a login.
- infogulch 5y agoI think the distinction you're trying to make means zilch, 1. this is the normal login flow for these users, 2. this tech provides zero protection from phishing attacks, 3. an extension does provide protection from phishing attacks by automatically comparing the saved domain vs the page's domain byte-for-byte on every visit and not suggesting a login if the actual domain doesn't match, 4. humans have empirically proven that they cannot do 3 reliably. There is a first hand experience of this fact in this very thread: "The only time I nearly lost an account to phishing it was because I manually copy-pasted my credentials.". "choosing to attempt to login" is just bare-faced whitewashing in order to blame the user for falling prey to a phishing attack and deny that this is a problem that password managers should solve.
- unethical_ban 5y agoAh, see that's where I didn't understand you. I did not make the assumption that my offline password manager should integrate with my web browser to provide phishing protection. That's not a bad idea! I'm not denying it's something password managers could solve. I just don't rely on it.