5 ms·

> The hard part of building a (good) password manager is ... correctly integrating it with every app and website that expects to take your passwords What's wro

> The hard part of building a (good) password manager is ... correctly integrating it with every app and website that expects to take your passwords What's wrong with plain old copy-and-paste? (I know there are probably some security concerns under X11, but Keepass, for example, will automatically clear the clipboard after a few seconds at least.) I use Keepass and 1password.com, but I don't use any of their autofill features; I just copy a password when I need it and paste it to where I need it. I think a user-friendly, secure, and reliable sync is the much more difficult part of implementing a good password manager.

deleted 4y ago
[deleted]
jonwinstanley 4y ago
Copy and paste is fine, plus most usernames are your email, which should auto complete
forty 4y ago
The issue with copy pasting password is phishing, which for most real life users is a much bigger risk than most other risks
deleted 4y ago
[deleted]
rollcat 4y ago
> What's wrong with plain old copy-and-paste? Context awareness. I currently have 429 items in my PM (it happens to be 1Password, specifically because it's extremely good at figuring this crap out). I almost never have to search for anything; even if I do, I can easily update the entry, so that it understands the context, in which a given credential can be valid; e.g. I can use my Blizzard login both on "https://battle.net https://battle.net", and in "app://sc2" (StarCraft 2). If I have a main+alt account, it will allow me to choose from the two, not 400+. It's the same as with using contactless payments with a smartwatch, it saves you 10 seconds here, a minute there - and over the course of your day, day after day - it starts adding up. > I think a user-friendly, secure, and reliable sync is the much more difficult part of implementing a good password manager. CRDTs solve this problem quite generally. I've never tried actually implementing sync from scratch in a desktop/mobile app, but the theory behind CRDTs is quite easy to grasp and makes a lot of sense. I'd say it's quite a bit harder to sync plain, old files, because the only metadata you have available is things like names, access/modification times, etc and they tend to be huge binary blobs, like photos or music, so the problem of automatic conflict resolution gets quite interesting. BTW look up Apple's CloudKit. I've done a "let's pretend we're on a 1990s Internet" challenge[1] a while ago, and it's amazing how reliably everything syncs, even if the devices are online for maybe 1% of the day. [1]: https://www.rollc.at/tags/challenge/ https://www.rollc.at/tags/challenge/

deleted 4y ago

[deleted]

jonwinstanley 4y ago

Copy and paste is fine, plus most usernames are your email, which should auto complete

forty 4y ago

The issue with copy pasting password is phishing, which for most real life users is a much bigger risk than most other risks

deleted 4y ago

[deleted]

rollcat 4y ago

> What's wrong with plain old copy-and-paste? Context awareness. I currently have 429 items in my PM (it happens to be 1Password, specifically because it's extremely good at figuring this crap out). I almost never have to search for anything; even if I do, I can easily update the entry, so that it understands the context, in which a given credential can be valid; e.g. I can use my Blizzard login both on "https://battle.net https://battle.net", and in "app://sc2" (StarCraft 2). If I have a main+alt account, it will allow me to choose from the two, not 400+. It's the same as with using contactless payments with a smartwatch, it saves you 10 seconds here, a minute there - and over the course of your day, day after day - it starts adding up. > I think a user-friendly, secure, and reliable sync is the much more difficult part of implementing a good password manager. CRDTs solve this problem quite generally. I've never tried actually implementing sync from scratch in a desktop/mobile app, but the theory behind CRDTs is quite easy to grasp and makes a lot of sense. I'd say it's quite a bit harder to sync plain, old files, because the only metadata you have available is things like names, access/modification times, etc and they tend to be huge binary blobs, like photos or music, so the problem of automatic conflict resolution gets quite interesting. BTW look up Apple's CloudKit. I've done a "let's pretend we're on a 1990s Internet" challenge[1] a while ago, and it's amazing how reliably everything syncs, even if the devices are online for maybe 1% of the day. [1]: https://www.rollc.at/tags/challenge/ https://www.rollc.at/tags/challenge/