2 ms·
It doesn't automatically fill it in by landing on the page. It can detect how to autofill, and what password to use, based on window title. Your scenario still
by unethical_ban 5y ago
It doesn't automatically fill it in by landing on the page. It can detect how to autofill, and what password to use, based on window title.
Your scenario still depends on the person landing on a phishing site and choosing to attempt a login.
- infogulch 5y agoI think the distinction you're trying to make means zilch, 1. this is the normal login flow for these users, 2. this tech provides zero protection from phishing attacks, 3. an extension does provide protection from phishing attacks by automatically comparing the saved domain vs the page's domain byte-for-byte on every visit and not suggesting a login if the actual domain doesn't match, 4. humans have empirically proven that they cannot do 3 reliably. There is a first hand experience of this fact in this very thread: "The only time I nearly lost an account to phishing it was because I manually copy-pasted my credentials.". "choosing to attempt to login" is just bare-faced whitewashing in order to blame the user for falling prey to a phishing attack and deny that this is a problem that password managers should solve.
- unethical_ban 5y agoAh, see that's where I didn't understand you. I did not make the assumption that my offline password manager should integrate with my web browser to provide phishing protection. That's not a bad idea! I'm not denying it's something password managers could solve. I just don't rely on it.