3 ms·
A password manager would detect that the site doesn't match, so unless you copy it out of the vault directly it's likely to keep you secure.
by pcthrowaway 5y ago
A password manager would detect that the site doesn't match, so unless you copy it out of the vault directly it's likely to keep you secure.
- Nextgrid 5y agoA lot of popular password managers share them across subdomains by default, so if you manage to get this on a subdomain of the target domain it'll work fine.
- lxgr 5y agoIf an attacker can get arbitrary content on a subdomain of your site, isn't that pretty much game over for credentials on the apex domain?
- darepublic 5y agothere are various times where I copy out the password manager password because it just doesnt play well with the site. this includes big sites like aws console btw
- saltminer 5y agoAt least with BitWarden, when I click on the extension icon, the site in question should still show up. If I have to search for it, either the domain has changed or something smells phishy.