3 ms·
Maybe I’m missing something, but why would you trust any app to securely store your passwords (or store them at all) but specifically mistrust their browser ext
by 1f60c 4y ago
Maybe I’m missing something, but why would you trust any app to securely store your passwords (or store them at all) but specifically mistrust their browser extension?
- vbezhenar 4y ago1. Browser extension interacts with every website by design. And it means that every website has a direct path to access my passwords if extension is buggy. I don't know how to solve this issue without special browser API, but requiring user to click for every step before sending actual data might reduce that attack surface compared to convenient automatic mode. 2. Web apps are wild and doing wild things. Even humans might find it hard to fill the form correctly. Extension can only observe DOM. Who knows which inputs it will fill with my passwords? I don't trust myself to write that kind of auto fill code which would work reliably. And if I don't trust myself, I definitely don't trust others to do so. I don't claim that extensions are malicious. That would not make sense indeed. Just that extensions are things I don't trust to be implemented correctly, especially with convenient auto-pilot mode.
- 1f60c 4y agoBoth are great points. Thanks!