4 ms·

> I remember when lastpass had a security hole that could expose every password in your vault by visiting a web page. I remember when KeePass browser plugin ha

> I remember when lastpass had a security hole that could expose every password in your vault by visiting a web page. I remember when KeePass browser plugin had the same issue. The security researchers were not paid.

pydry 5y ago
I'd avoid using that too then.
- tuwtuwtuwtuw 5y ago
  Would you avoid using any password storage where either the system itself or the underlying foundation has had serious vulnerabilities at some point? Or only bad vulnerabilities triggered using JavaScript? Or would you only accept a history with vulnerabilities if security researchers were paid properly for the work they invested into finding the issues?
  - pydry 5y ago
    I tend to prefer open source but slightly obscure open source with a few unpaid maintainers and a very high attack surface? Yeah, I'd avoid that too. I have much more confidence in open source password storage that doesnt try to autofill. Theres much less that can go wrong. This is how I store banking passwords. A serious vulnerability puts me off but not as much as a tepid ass response that tries to downplay the severity of a really bad problem. That makes me consider the software radioactive.
    - SAI_Peregrinus 5y ago
      KeePass (and the forks like KeePassXC) doesn't try to autofill passwords. There's a separate browser plugin (different download, not installed or recommended by default) for KeePass that did, and that's where the vulnerability was.
      - pydry 5y ago
        I was alluding to this when I said "slightly obscure". I still use KeePass, but not that plugin.
- boringg 5y ago
  What about 1password?
  - ChrisMarshallNY 5y ago
    I've used 1Password for years. I recommend it to orgs I work with.
- TonyTrapp 5y ago
  KeePass is a free software, not a service that generates revenue. Why would you expect a free software developer that is entirely funded by donations (which most likely won't even cover development costs) to pay 10,000$ to a security researcher finding a bug in their software or you will stop using their software? This is completely unrealistic. Bugs happen, free software exists. You cannot stop using all free software that had a security bug in the past that wasn't awarded with 10,000$.
  - pydry 5y ago
    I didnt say I did expect bounties from them. I just said I'd avoid using this software. The fact remains that autofilling passwords in-browser has a gargantuan attack surface and hence the potential to go very wrong. You have to really trust whichever software you use for this. I expected better from lastpass because I used to give them actual money. I'm not upset that some random keepass extension did this but I also wouldnt use it either.
    - SAI_Peregrinus 5y ago
      KeePass doesn't come with the browser plugin, BTW. It's a separate, optional download.
      - pydry 5y ago
        I know.
arsome 5y ago
Important to note that KeePass itself does not have an official browser plug in, all plug-ins are 3rd party and none have large commercial backing. Several browser plug-ins are available as well as simpler solutions like a browser extension to insert the URL in the title bar and sending keystrokes to the browser to populate it.
- tuwtuwtuwtuw 5y ago
  That is a very good point. I am not sure that lack of official browser extension is a good thing though. I typically enjoy when software has a large community creating plug-ins, but maybe not when it comes to password managers.
  - sharps1 5y ago
    Password manager browser extensions provide a large attack surface. They also break the browser sandbox. I wish there were a good solution https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html
    - simpleguitar 5y ago
      > I wish there were a good solution The answer is right there in the article: Use the browser's password manager. I find Firefox's password manager + Sync a good solution, and I don't understand why people don't advocate it more. It's free and open source. Mozilla is a reputable software house with a good security team. Their revenue stream does not depend on you paying for the password manager. It doesn't even depends on monetizing your personal information. Yesterday I found it even works as a password store for all of iOS.
      - workethics 5y ago
        How do you manage passwords for things outside of the browser?
        5y ago
wodenokoto 5y ago
KeePass is open source. Who would pay?

pydry 5y ago

I'd avoid using that too then.

tuwtuwtuwtuw 5y ago
Would you avoid using any password storage where either the system itself or the underlying foundation has had serious vulnerabilities at some point? Or only bad vulnerabilities triggered using JavaScript? Or would you only accept a history with vulnerabilities if security researchers were paid properly for the work they invested into finding the issues?
- pydry 5y ago
  I tend to prefer open source but slightly obscure open source with a few unpaid maintainers and a very high attack surface? Yeah, I'd avoid that too. I have much more confidence in open source password storage that doesnt try to autofill. Theres much less that can go wrong. This is how I store banking passwords. A serious vulnerability puts me off but not as much as a tepid ass response that tries to downplay the severity of a really bad problem. That makes me consider the software radioactive.
  - SAI_Peregrinus 5y ago
    KeePass (and the forks like KeePassXC) doesn't try to autofill passwords. There's a separate browser plugin (different download, not installed or recommended by default) for KeePass that did, and that's where the vulnerability was.
    - pydry 5y ago
      I was alluding to this when I said "slightly obscure". I still use KeePass, but not that plugin.
boringg 5y ago
What about 1password?
- ChrisMarshallNY 5y ago
  I've used 1Password for years. I recommend it to orgs I work with.
TonyTrapp 5y ago
KeePass is a free software, not a service that generates revenue. Why would you expect a free software developer that is entirely funded by donations (which most likely won't even cover development costs) to pay 10,000$ to a security researcher finding a bug in their software or you will stop using their software? This is completely unrealistic. Bugs happen, free software exists. You cannot stop using all free software that had a security bug in the past that wasn't awarded with 10,000$.
- pydry 5y ago
  I didnt say I did expect bounties from them. I just said I'd avoid using this software. The fact remains that autofilling passwords in-browser has a gargantuan attack surface and hence the potential to go very wrong. You have to really trust whichever software you use for this. I expected better from lastpass because I used to give them actual money. I'm not upset that some random keepass extension did this but I also wouldnt use it either.
  - SAI_Peregrinus 5y ago
    KeePass doesn't come with the browser plugin, BTW. It's a separate, optional download.
    - pydry 5y ago
      I know.

arsome 5y ago

Important to note that KeePass itself does not have an official browser plug in, all plug-ins are 3rd party and none have large commercial backing. Several browser plug-ins are available as well as simpler solutions like a browser extension to insert the URL in the title bar and sending keystrokes to the browser to populate it.

tuwtuwtuwtuw 5y ago
That is a very good point. I am not sure that lack of official browser extension is a good thing though. I typically enjoy when software has a large community creating plug-ins, but maybe not when it comes to password managers.
- sharps1 5y ago
  Password manager browser extensions provide a large attack surface. They also break the browser sandbox. I wish there were a good solution https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html
  - simpleguitar 5y ago
    > I wish there were a good solution The answer is right there in the article: Use the browser's password manager. I find Firefox's password manager + Sync a good solution, and I don't understand why people don't advocate it more. It's free and open source. Mozilla is a reputable software house with a good security team. Their revenue stream does not depend on you paying for the password manager. It doesn't even depends on monetizing your personal information. Yesterday I found it even works as a password store for all of iOS.
    - workethics 5y ago
      How do you manage passwords for things outside of the browser?
      - 5y ago

wodenokoto 5y ago

KeePass is open source. Who would pay?