3 ms·

It's not in transit, it's the equivalent of storing your passwords in plaintext, which I don't think can be actually defended as a good practice. Regardless th

It's not in transit, it's the equivalent of storing your passwords in plaintext, which I don't think can be actually defended as a good practice. Regardless the question that arises which is a lot more worrisome is what happens when you turn on synchronization on these browsers? Do they encrypt the passwords with a key only you know? Or do they just ship the "encrypted" passwords along with the key, so that your passwords are now essentially plaintext on their servers?

lucideer 4y ago
> which I don't think can be actually defended as a good practice Allow me to try defending it: Even storing your passwords in plaintext locally using an integrated password manager would: 1. discourage password reuse 2. usually encourage generated strong passwords/phrases (best password is one you don't know) 3. allow easy automated password auditing 4. prevent phishing-based credential capture via domain matching Just point (1) above is a much greater threat than the likelihood of physical access (or rootkit/malware in which case key logging would invalidate keyed encryption either way) > what happens when you turn on synchronization on these browsers? [...] Or do they just ship the "encrypted" passwords along with the key, so that your passwords are now essentially plaintext on their servers? The typical approach is to ship the encrypted password without the key: provided it's a key known by the user, this makes it easy to download the encrypted credentials on any device and decrypt locally. If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable.
- throwawayffffas 4y ago
  > If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable. My guess would be that they use the users authentication credentials, but I am not confident that they do.

lucideer 4y ago

> which I don't think can be actually defended as a good practice Allow me to try defending it: Even storing your passwords in plaintext locally using an integrated password manager would: 1. discourage password reuse 2. usually encourage generated strong passwords/phrases (best password is one you don't know) 3. allow easy automated password auditing 4. prevent phishing-based credential capture via domain matching Just point (1) above is a much greater threat than the likelihood of physical access (or rootkit/malware in which case key logging would invalidate keyed encryption either way) > what happens when you turn on synchronization on these browsers? [...] Or do they just ship the "encrypted" passwords along with the key, so that your passwords are now essentially plaintext on their servers? The typical approach is to ship the encrypted password without the key: provided it's a key known by the user, this makes it easy to download the encrypted credentials on any device and decrypt locally. If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable.

throwawayffffas 4y ago
> If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable. My guess would be that they use the users authentication credentials, but I am not confident that they do.