2 ms·
The problem is not on the browser interface side but on the interface of the secure password store: here you would need to give your ok (like with a hw key). At
by riedel 5y ago
The problem is not on the browser interface side but on the interface of the secure password store: here you would need to give your ok (like with a hw key). At least in my password manager it seems possible to impersonate the browser after extracting the shared communication token and then query the whole database once it is unlocked from a random client.
- infogulch 5y agoWhat's the threat model you are considering?
- riedel 5y agoWell considering that the local password managers make a great fuzz about memory randomisation and protection of localhost communication, I would consider a trojan running under user privileges a threat myself that a password manager should address. Otherwise it seems little better than a plaintext password file saved on an encrypted hard drive. However, my point is that mostly I just want to know what the software is good for, ie. protecting me against.