3 ms·

> The alternative right now is to use the same password everywhere. That's even worse. Or to just use the browser's saving functionality and never push your pa

by Izkata 4y ago

> The alternative right now is to use the same password everywhere. That's even worse. Or to just use the browser's saving functionality and never push your passwords online in the first place. They're probably only using one primary device like me; I generally don't log in to stuff on my phone, or personal stuff on my work laptop/work stuff on my personal laptop. If their habits are like mine then these cloud password services are pretty pointless.

fullstop 4y ago
You're unlike most people in that regard. I'm signed into services on at least two or three devices -- a desktop, a laptop, and my phone. Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow? I don't know if this has changed, but a few years ago the stored passwords in Chrome were stored unencrypted in a sqlite3 database. (on Linux, at least) I'd use an audited service such as Bitwarden or roll my own Keepass thing before using the browser's saved password feature. All it would take is one RCE exploit in a browser to expose your passwords.
- Izkata 4y ago
  > Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow? This has already happened a few times over the past decade: I restore from local backups.
  - fullstop 4y ago
    Okay, one step further then. What happens if your house burns down? Eventually you will want some sort of offsite backup. Also: https://ohyicong.medium.com/how-to-hack-chrome-password-with-python-1bedc167be3d https://ohyicong.medium.com/how-to-hack-chrome-password-with... Passwords are still easy to obtain outside of Chrome, and apparently Firefox is just as easy. By using the browser's saved password feature you are one RCE away from someone being able to automate the extraction of all of your passwords.
    - Izkata 4y ago
      I have one, and minimal one on my keychain, both in an encrypted disk image I do memorize the password for. I'm pretty sure on Firefox if you have the master password set, they're actually encrypted, and has done that for a long time.
mrWiz 4y ago
I think that using multiple devices is probably by far the most common use case. Personally I have my own PC, a work laptop, and a phone that I regularly use, and a tablet that I use irregularly (but often enough that I want my account information available).
deleted 4y ago
[deleted]

by Izkata 4y ago

fullstop 4y ago

You're unlike most people in that regard. I'm signed into services on at least two or three devices -- a desktop, a laptop, and my phone. Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow? I don't know if this has changed, but a few years ago the stored passwords in Chrome were stored unencrypted in a sqlite3 database. (on Linux, at least) I'd use an audited service such as Bitwarden or roll my own Keepass thing before using the browser's saved password feature. All it would take is one RCE exploit in a browser to expose your passwords.

Izkata 4y ago
> Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow? This has already happened a few times over the past decade: I restore from local backups.
- fullstop 4y ago
  Okay, one step further then. What happens if your house burns down? Eventually you will want some sort of offsite backup. Also: https://ohyicong.medium.com/how-to-hack-chrome-password-with-python-1bedc167be3d https://ohyicong.medium.com/how-to-hack-chrome-password-with... Passwords are still easy to obtain outside of Chrome, and apparently Firefox is just as easy. By using the browser's saved password feature you are one RCE away from someone being able to automate the extraction of all of your passwords.
  - Izkata 4y ago
    I have one, and minimal one on my keychain, both in an encrypted disk image I do memorize the password for. I'm pretty sure on Firefox if you have the master password set, they're actually encrypted, and has done that for a long time.

mrWiz 4y ago

I think that using multiple devices is probably by far the most common use case. Personally I have my own PC, a work laptop, and a phone that I regularly use, and a tablet that I use irregularly (but often enough that I want my account information available).

deleted 4y ago

[deleted]