6 ms·
I turned this off. It is possible that the site gets hacked and your password manager automatically fills it in, the attacker now can read the password (via emb
by latchkey 4y ago
I turned this off. It is possible that the site gets hacked and your password manager automatically fills it in, the attacker now can read the password (via embedded javascript) that you've filled into the field without even submitting it first. By making this a manual process, it at least gives you a fighting chance.
- brigandish 4y agoHow would you know that the site's been hacked, and if you do, why would you visit it?
- autotune 4y agoI recently was looking into the possibility of finding a local tax prep service for the mess that is my taxes from 2020. I stumbled upon a website that was highly rated on Google and looked completely professional, so naturally I let my guard down a bit while browsing it. Before I knew it one of their navigation links in this otherwise professional looking site redirected me to some malware spewing porn site that probably would have downloaded and installed itself on my machine if I was not using uBlock Origin and on Mac. It's super easy to get tricked these days even when you are security conscious 95 percent of the time, it only takes that one 5 percent chance to go wrong.
- latchkey 4y agoI don't know that the site has been hacked, that's the point. I'd rather not automatically throw my password into a form when I visit a site. It seems like a kind of obvious thing to me.
- albuic 4y agoThe goal of a password manager is to use random password, one generated for each website, so that if one is leaked... Well, nothing more ! So having autofill is a good feature.
- latchkey 4y agoSure and I use that feature... But, you aren't thinking like a hacker. Leaking one site could allow someone access into another site. For example, if I've integrated API keys from one site into another. It is those sorts of targets that hackers really look for.
- knaik94 4y agoIt shouldn't matter as long as you don't reuse your password. If the site is hacked to the point where someone can inject javascript, I'd assume all of my data has already been compromised without logging in.
- latchkey 4y ago> I'd assume all of my data has already been compromised without logging in. Not entirely true. If the site requires your login in order to, say, decrypt your server side data, then even if the site is compromised, your data is still secure, until you log in. I'm making this up as a possibility, I've never seen or heard of a site that actually did that. Regardless, I'd rather error on the side of caution. There are too many things that I don't know about here that could be possible. Automatically filling in my password somewhere seems like an obvious thing to be cautious about.