3 ms·
Actually interestingly point number one probably holds true, since very few GUI password managers actually document their threat model at all and actually evalu
by riedel 5y ago
Actually interestingly point number one probably holds true, since very few GUI password managers actually document their threat model at all and actually evaluate their design decisions accordingly.
E.g. typical browser extensions if used with no additional confirmation allow easy local exfiltration of passwords. Particularly if actual user input on each request is needed TOTP would provide additional benefits (similar to your fido key button press). Password managers often compromise the effort of a single click for much less security of autofill.
- infogulch 5y agoDepending on your perspective, a password manager with autofill could actually be more secure. If password managers autofill or suggest accounts based on matching domain, then you're insulated from phishing attacks due to not validating the domain. If you always copy-paste your credentials, you are relying on your own perfect vigilance in checking the domain when pasting the password for the intended site into the actual site. By using autofill or autosuggest, the computer is checking the domain for you and the failure to autofill or find related credentials can indicate a phishing attempt by disrupting your expectations.
- vladvasiliu 5y agoI think that auto-suggest, meaning the password manager only suggests a password, but you need to actively click on the suggestion in order for the password to be entered, would satisfy both requirements: mitigate phishing and exfiltration. This is the default for 1password.
- Macha 5y agoThis is also the case for bitwarden. I think it's only browser built in autofill that does it proactively
- paulryanrogers 5y agoBitwarden has an auto fill option, though it was off by default last I checked. LastPass too has auto fill yet mitigated by requiring a click to populate the match.
- AdmiralAsshat 5y ago> LastPass too has auto fill yet mitigated by requiring a click to populate the match. Actually, if you login/authenticate to LastPass, it will automatically autofill the forms within all of your open tabs. It's quite irritating--I haven't figured out a way to disable it.
- riedel 5y agoThe problem is not on the browser interface side but on the interface of the secure password store: here you would need to give your ok (like with a hw key). At least in my password manager it seems possible to impersonate the browser after extracting the shared communication token and then query the whole database once it is unlocked from a random client.
- infogulch 5y agoWhat's the threat model you are considering?
- riedel 5y agoWell considering that the local password managers make a great fuzz about memory randomisation and protection of localhost communication, I would consider a trojan running under user privileges a threat myself that a password manager should address. Otherwise it seems little better than a plaintext password file saved on an encrypted hard drive. However, my point is that mostly I just want to know what the software is good for, ie. protecting me against.
- hjkl0 5y agoI remember KeePass had a feature where the autofill was supposed to be safe against key loggers (as opposed to typing out the password yourself)