17 ms·
all the speculation in that thread about how the password could have been leaked reminded me of a post earlier this year that drastically changed my view on pas
by Barrin92 5y ago
all the speculation in that thread about how the password could have been leaked reminded me of a post earlier this year that drastically changed my view on password managers. (also generated a lot of discussion here)
https://news.ycombinator.com/item?id=27407603 https://news.ycombinator.com/item?id=27407603
- gruez 5y agoSeems like the lesson there is to use a standalone password manager, rather than one that's a browser extension?
- tim333 5y agoSome guy did an long analysis and figured for most purposes you are as well to use the built in ones in Chrome or Firefox. Personally I kind of like Bitwarden.
- denton-scratch 5y agoI'm not inclined to run anything that's remotely related to password security in a browser extension (I do use the Firefox built-in password manager to simplify logging in to sites like this one, where I have no money at stake and nothing much to lose but my pride). For high-value logins, I use Passwordsafe. It's annoying; the scroll behaviour is annoying, and it's Windows-only, which is sad. But it's resolutely local and un-networked, and I'm confident that my secrets are well-protected by my (complex, long, memorized) master password.
- mbordenet 5y agoAssuming you're talking about pwsafe 3, it's not Windows-only. I am actively using a Java implementation on MacOS and rely on my Android app for frequent use. Password file is synced across devices via a cloud drive provider. Works great, and I'm in control. (I also rotate my password file + master password every few months.)
- boring_twenties 5y agoWhy not the one built in to the browser?
- CyberRage 5y agoIt doesn't compromise the master-password and is not wide-reaching as it requires the victim to be lured to a specific website. Doesn't match what people claim here