9 ms·

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwo

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have existed for SSL certificates the other day. Unfortunately some sites require you to "log in with your ... credentials" rather than doing SSO. But you TOFU those, too, once you've verified they're legit. Happy Bitwarden user here: the software is all Free, but I trust the company to run their servers securely more than I trust myself to, so I pay them to do so. Extra benefit: if I lose all my infrastructure, I haven't lost my passwords.

makeworld 5y ago
> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. The Bitwarden browser extension does this. When you add a login, it also adds the URI of the website, so the login info and auto-fill will only show up when you're on the same domain. Of course you can edit and add or remove your own URIs for logins. You can also change the URI matching behaviour.
- andrewaylett 5y ago
  Yes, and this is what I use.
  - makeworld 5y ago
    I'm sorry, I misread your first sentence and thought you were saying you hadn't seen any password managers that defend against phishing. My bad!
a1445c8b 5y ago
> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. 1Password does this.
- max1cc 5y ago
  It also warns if you try to fill on a site that isn't linked (says something like "1Password can't verify that reaibank.com should use your realbank.com login"
reedjosh 5y ago
I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.
- kevincox 5y ago
  I would argue it is trust. I trust my password manager to validate the website I am entering my password into more than I trust my eyes. I know that I can't be perfectly vigilant every single time I enter my password. The risk of the password manager betraying me is roughly an order of magnitude below the risk of my falling for a phishing attack. Plus I use the password manager baked into my browser, so I'm basically trusting it anyways.
- antihero 5y ago
  I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.
  - fsflover 5y ago
    > because it’s a company that happily makes money from that trust You could also say this about Microsoft, except they've been breaking such trust for a long time.
    - rewgs 5y ago
      That's a pretty obviously bad take. You're comparing a company whose single product is about keeping one kind of thing secure, and another company that makes dozens of products, most of which don't explicitly have to do with security.
      - arepublicadoceu 5y ago
        I’m not an expert by any means but I have a layman sense that keeping Windows safe is a way more gargantuan task than keeping an encrypted vault safe inside my computer (before 1password moved to this cloud nonsense to milk subscription money). If my windows is compromised no amount of tech wizardry can protect my 1password credentials.
diarrhea 5y ago
> Extra benefit: if I lose all my infrastructure, I haven't lost my passwords. I just dump the SQL database of Vaultwarden and have that as a backup (it's encrypted). I've verified that a new Vaultwarden instance can be spun up on any Docker-capable machine quickly, the SQL file just needs to be mounted in and named properly. So it's a very localhost-friendly backup with no 'infrastructure' requirements. It can be up in minutes.
- mekster 5y ago
  I suppose you're not saving attachments.
  - diarrhea 5y ago
    I am, these are in a separate directory that needs to be treated analogously. It's also pretty painless. Still, if you just want to save your ass, the DB is probably what one is after.
mdellavo 5y ago
browserpass for the pass password manager does this
cheald 5y ago
> which some folk were wishing might have existed for SSL certificates the other day Isn't this basically what HSTS + cert pinning does?
- BeefWellington 5y ago
  Cert Pinning is more akin to "trust on zeroth use, only this certificate", HSTS is kind of unrelated since all it does it tell the browser to access the site via HTTPS. If the site is on the preload list all that buys you is the first access must be over TLS. Pinning is more for the app case, HSTS more for the browser case.
- andrewaylett 5y ago
  HSTS and pinning (which isn't used on web any more, because it's too much of a foot-gun) help you be sure that you're really talking to who your computer thinks you're talking to. A password manager (or, better WebAuthn) helps you be sure you're talking to the same site that you were talking to when you set up your account. If you're on the wrong site, all the validity indicators in the world won't help the misidentification. And it needn't even be a malicious site: I auto-fill my work credentials in part so that I don't have to remember which internal tools take which set of credentials. Which isn't nearly as much of an issue nowadays (with more SSO) as it was a few years ago, but that just makes the last few exceptions all the more difficult to remember.
kgc 5y ago
1password does this unless I'm misunderstanding your post.
- andrewaylett 5y ago
  Yes! As far as I'm aware the "cloudy" password managers all do it.
hughrr 5y ago
Apple keychain?
- andrewaylett 5y ago
  If I were an Apple ecosystem person, certainly.
- themadturk 5y ago
  The only problem with that is you have to be all-in on Apple to make it work. I certainly use it on my MacBook, iPhone and iPad, but I also still use LastPass because my Windows machine doesn't know anything about the keychain.
  - hughrr 5y ago
    I carefully eviscerated windows from my life. It’s better that way if you can do it.
    - themadturk 5y ago
      For some of us, it goes beyond personal choice. We have to consider our families and their circumstances as well. My wife and I could do it...if I worked for another employer (I'm fairly close to retirement and am not expecting to go job hunting between now and then) and if our adult children, who share my family password manager account, would only realize they shouldn't be using Windows and Android (and also had the money to throw out their hardware and buy all Apple stuff).
commandersaki 5y ago
Yep agreed. I just have a small anecdote. My credentials were stolen when altoira.com was domain hijacked and setup a phishing campaign -- even when using 1Password to manage my credentials. Thankfully when they restored everything and require a reset of passwords, they offered TOTP 2FA which would provide an additional defence when phishing succeeds.

makeworld 5y ago

> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. The Bitwarden browser extension does this. When you add a login, it also adds the URI of the website, so the login info and auto-fill will only show up when you're on the same domain. Of course you can edit and add or remove your own URIs for logins. You can also change the URI matching behaviour.

andrewaylett 5y ago
Yes, and this is what I use.
- makeworld 5y ago
  I'm sorry, I misread your first sentence and thought you were saying you hadn't seen any password managers that defend against phishing. My bad!

a1445c8b 5y ago

> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. 1Password does this.

max1cc 5y ago
It also warns if you try to fill on a site that isn't linked (says something like "1Password can't verify that reaibank.com should use your realbank.com login"

reedjosh 5y ago

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.

kevincox 5y ago
I would argue it is trust. I trust my password manager to validate the website I am entering my password into more than I trust my eyes. I know that I can't be perfectly vigilant every single time I enter my password. The risk of the password manager betraying me is roughly an order of magnitude below the risk of my falling for a phishing attack. Plus I use the password manager baked into my browser, so I'm basically trusting it anyways.
antihero 5y ago
I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.
- fsflover 5y ago
  > because it’s a company that happily makes money from that trust You could also say this about Microsoft, except they've been breaking such trust for a long time.
  - rewgs 5y ago
    That's a pretty obviously bad take. You're comparing a company whose single product is about keeping one kind of thing secure, and another company that makes dozens of products, most of which don't explicitly have to do with security.
    - arepublicadoceu 5y ago
      I’m not an expert by any means but I have a layman sense that keeping Windows safe is a way more gargantuan task than keeping an encrypted vault safe inside my computer (before 1password moved to this cloud nonsense to milk subscription money). If my windows is compromised no amount of tech wizardry can protect my 1password credentials.

diarrhea 5y ago

> Extra benefit: if I lose all my infrastructure, I haven't lost my passwords. I just dump the SQL database of Vaultwarden and have that as a backup (it's encrypted). I've verified that a new Vaultwarden instance can be spun up on any Docker-capable machine quickly, the SQL file just needs to be mounted in and named properly. So it's a very localhost-friendly backup with no 'infrastructure' requirements. It can be up in minutes.

mekster 5y ago
I suppose you're not saving attachments.
- diarrhea 5y ago
  I am, these are in a separate directory that needs to be treated analogously. It's also pretty painless. Still, if you just want to save your ass, the DB is probably what one is after.

mdellavo 5y ago

browserpass for the pass password manager does this

cheald 5y ago

> which some folk were wishing might have existed for SSL certificates the other day Isn't this basically what HSTS + cert pinning does?

BeefWellington 5y ago
Cert Pinning is more akin to "trust on zeroth use, only this certificate", HSTS is kind of unrelated since all it does it tell the browser to access the site via HTTPS. If the site is on the preload list all that buys you is the first access must be over TLS. Pinning is more for the app case, HSTS more for the browser case.
andrewaylett 5y ago
HSTS and pinning (which isn't used on web any more, because it's too much of a foot-gun) help you be sure that you're really talking to who your computer thinks you're talking to. A password manager (or, better WebAuthn) helps you be sure you're talking to the same site that you were talking to when you set up your account. If you're on the wrong site, all the validity indicators in the world won't help the misidentification. And it needn't even be a malicious site: I auto-fill my work credentials in part so that I don't have to remember which internal tools take which set of credentials. Which isn't nearly as much of an issue nowadays (with more SSO) as it was a few years ago, but that just makes the last few exceptions all the more difficult to remember.

kgc 5y ago

1password does this unless I'm misunderstanding your post.

andrewaylett 5y ago
Yes! As far as I'm aware the "cloudy" password managers all do it.

hughrr 5y ago

Apple keychain?

andrewaylett 5y ago
If I were an Apple ecosystem person, certainly.
themadturk 5y ago
The only problem with that is you have to be all-in on Apple to make it work. I certainly use it on my MacBook, iPhone and iPad, but I also still use LastPass because my Windows machine doesn't know anything about the keychain.
- hughrr 5y ago
  I carefully eviscerated windows from my life. It’s better that way if you can do it.
  - themadturk 5y ago
    For some of us, it goes beyond personal choice. We have to consider our families and their circumstances as well. My wife and I could do it...if I worked for another employer (I'm fairly close to retirement and am not expecting to go job hunting between now and then) and if our adult children, who share my family password manager account, would only realize they shouldn't be using Windows and Android (and also had the money to throw out their hardware and buy all Apple stuff).

commandersaki 5y ago

Yep agreed. I just have a small anecdote. My credentials were stolen when altoira.com was domain hijacked and setup a phishing campaign -- even when using 1Password to manage my credentials. Thankfully when they restored everything and require a reset of passwords, they offered TOTP 2FA which would provide an additional defence when phishing succeeds.