3 ms·
I think that auto-suggest, meaning the password manager only suggests a password, but you need to actively click on the suggestion in order for the password to
by vladvasiliu 5y ago
I think that auto-suggest, meaning the password manager only suggests a password, but you need to actively click on the suggestion in order for the password to be entered, would satisfy both requirements: mitigate phishing and exfiltration. This is the default for 1password.
- Macha 5y agoThis is also the case for bitwarden. I think it's only browser built in autofill that does it proactively
- paulryanrogers 5y agoBitwarden has an auto fill option, though it was off by default last I checked. LastPass too has auto fill yet mitigated by requiring a click to populate the match.
- AdmiralAsshat 5y ago> LastPass too has auto fill yet mitigated by requiring a click to populate the match. Actually, if you login/authenticate to LastPass, it will automatically autofill the forms within all of your open tabs. It's quite irritating--I haven't figured out a way to disable it.
- riedel 5y agoThe problem is not on the browser interface side but on the interface of the secure password store: here you would need to give your ok (like with a hw key). At least in my password manager it seems possible to impersonate the browser after extracting the shared communication token and then query the whole database once it is unlocked from a random client.
- infogulch 5y agoWhat's the threat model you are considering?
- riedel 5y agoWell considering that the local password managers make a great fuzz about memory randomisation and protection of localhost communication, I would consider a trojan running under user privileges a threat myself that a password manager should address. Otherwise it seems little better than a plaintext password file saved on an encrypted hard drive. However, my point is that mostly I just want to know what the software is good for, ie. protecting me against.