5 ms·
Does this provide any benefit over a (properly used) password manager? I’d be happy with just: - an “alphabet”, “minlength” and “maxlength” attributes on pass
by teeray 5y ago
Does this provide any benefit over a (properly used) password manager?
I’d be happy with just:
- an “alphabet”, “minlength” and “maxlength” attributes on password fields so password managers generate perfect passwords every time
- a well-known URI for password managers to do zero-touch password rotation.
- actual elements for login components to close the confused deputy attack for password managers.
All these things would be much easier changes for crufty old sites to make, which would aid adoption.
- yakak 5y agoFirst you need to invent a password manager that can be properly used? The one I have runs on my computer and trusts everything else I've ever installed not to have put in a mechanism to observe memory allocated to my browser.
- teeray 5y agoIs that how most credentials are stolen these days?
- Sahbak 5y agoMost attacks are social engineering. Everything else, to the best of my knowledge, does not target passwords
- judge2020 5y agoThe biggest attack is persistent login tokens that are stored on a device, eg. Discord has an issue with malware (disguised as DMs from random people asking "do you want to try out a beta for my game") that steals the login token from appdata, using it to purchase a bunch of gifted nitro and perpetuate the scam via that user's account.
- raxxorraxor 5y agoUsers opening shady attachments or going to amarzön.se and logging in are probably 99% of cases.
- fullstop 5y agoA keylogger can take my password but a Yubikey can not be copied.
- vngzs 5y agoIf you're copying passwords out of a password manager and pasting them into password fields, then yes, you're getting a significant improvement to phishing protection with a hardware key. If you're using the password manager's autofill feature, and that autofill feature is bug-free, then you're not getting any additional phishing protection. Your passwords can still be stolen, however. Any hardware authentication mechanism is going to ensure that no matter how compromised your local machine is, the worst an attacker can do is steal one active session. They can't steal the secret required to initiate any future session.
- tadfisher 5y agoIf the password manager stores the requesting site with the secret, either manually or through TOFU, then it has an opportunity to provide better phishing protection than manual copying. This is how Android Password Store [1] works, and it regularly triggers a phishing warning (that I have to override with multiple taps) when I'm trying it out by attempting to autofill a password for one app with the password associated with a different app ID. Granted, I also use it with my Yubikey, because that's what holds the GPG decryption key. [1]: https://github.com/android-password-store/Android-Password-Store https://github.com/android-password-store/Android-Password-S...