6 ms·
If you're copying passwords out of a password manager and pasting them into password fields, then yes, you're getting a significant improvement to phishing prot
by vngzs 4y ago
If you're copying passwords out of a password manager and pasting them into password fields, then yes, you're getting a significant improvement to phishing protection with a hardware key. If you're using the password manager's autofill feature, and that autofill feature is bug-free, then you're not getting any additional phishing protection.
Your passwords can still be stolen, however. Any hardware authentication mechanism is going to ensure that no matter how compromised your local machine is, the worst an attacker can do is steal one active session. They can't steal the secret required to initiate any future session.
- tadfisher 4y agoIf the password manager stores the requesting site with the secret, either manually or through TOFU, then it has an opportunity to provide better phishing protection than manual copying. This is how Android Password Store [1] works, and it regularly triggers a phishing warning (that I have to override with multiple taps) when I'm trying it out by attempting to autofill a password for one app with the password associated with a different app ID. Granted, I also use it with my Yubikey, because that's what holds the GPG decryption key. [1]: https://github.com/android-password-store/Android-Password-Store https://github.com/android-password-store/Android-Password-S...