3 ms·

I disagree, mostly because the password manager is more than just a place to store passwords. The origin binding also prevents you from typing the password on t

I disagree, mostly because the password manager is more than just a place to store passwords. The origin binding also prevents you from typing the password on the wrong domain. For many people they’re probably more likely to get phished for a memorized password than pwned for a managed password.

hunter2_ 4y ago
I wonder if there's an app/extension that streamlines remembering/autofilling usernames but not passwords. I doubt many people would be into it, but it would be the best of both worlds for the case you describe, I think. Or simply a personal allow list of origins, with a happy green indicator prominently overlaid onto login forms on those origins you've saved -- doesn't even need username storage. Maybe even a community-sourced allow list, but that would need some seriously trusted management (including purging upon domain registration expiry/transfer) but that would mostly duplicate the domain warnings that browsers already offer, anyhow.
- deleted 4y ago
  [deleted]
criddell 4y ago
That's a good point that I hadn't thought of before. I used LastPass for years and switched to BitWarden a couple of years ago. I did delete my LastPass account after switching, but I have zero confidence that they actually deleted my data. Fortunately, my master password from back then is long and complicated.
- BowBun 4y ago
  Yet another point of absurdity. Only if I live in California do I have the right to demand a company clear all my personal data. Meanwhile we have multiple large organizations that have hemorrhaged data to the world and caused irreparable harm to individuals, with little or no consequences. We're all held hostage by tech.
swyx 4y ago
ive thought of a mitigation for this - always intentionally enter the wrong password on the first try. if you're being phished, you'll notice when the wrong password gets you in
- function_seven 4y ago
  I thought some phishing attacks act as a relay or middle-man? I don't know how common that is.
  - coder543 4y ago
    100% correct. You might have 2 factor enabled, so they also need to check that and phish the 2FA code as well. That 2FA code expires quickly, so it needs to be used in real time to get a session. I'm sure there are some very basic phishing attacks that just save whatever you entered, but... let's avoid trying to come up with "clever hacks" that only lend a false sense of security.
- eviks 4y ago
  a much more convenient mitigation - create an item without a password, so it would autofill username (and not autofill if you're being phished, so domains wouldn't match), so all you'd have to do is enter the password from memory
eviks 4y ago
You can create an item without a password for this purpose - it would show an indicator if you have an account at a given domain, would even autofill the user name But you still get to save the critical password from the poor security of password managers Win Win
- coder543 4y ago
  > the critical password from the poor security of password managers Just because one restaurant has a bad health inspection score and is constantly making everyone who eats there sick does not mean all restaurants are bad. People who just lump "password managers" into one group are fundamentally assuming that one bad password manager means that all password managers are automatically bad, we just somehow don't know it yet. Don't bother eating at restaurants ever again if you feel that way, I guess. I know people who have gotten sick eating at restaurants, but that doesn't stop me from finding good restaurants. Most password managers have a very good security track record. Users creating and remembering their own passwords does not have a good security track record at all. Better to use a completely offline password manager (which risks you losing your backups or getting into a conflicting sync state) than no password manager at all, but a password manager that actually encrypts all your data end to end (which LastPass does not) and requires a strong key to unlock (such as the 2SKD method, which again... LastPass does not) is extremely safe, even if you don't trust "the cloud", because you don't need to trust the cloud.

hunter2_ 4y ago

I wonder if there's an app/extension that streamlines remembering/autofilling usernames but not passwords. I doubt many people would be into it, but it would be the best of both worlds for the case you describe, I think. Or simply a personal allow list of origins, with a happy green indicator prominently overlaid onto login forms on those origins you've saved -- doesn't even need username storage. Maybe even a community-sourced allow list, but that would need some seriously trusted management (including purging upon domain registration expiry/transfer) but that would mostly duplicate the domain warnings that browsers already offer, anyhow.

deleted 4y ago
[deleted]

criddell 4y ago

That's a good point that I hadn't thought of before. I used LastPass for years and switched to BitWarden a couple of years ago. I did delete my LastPass account after switching, but I have zero confidence that they actually deleted my data. Fortunately, my master password from back then is long and complicated.

BowBun 4y ago
Yet another point of absurdity. Only if I live in California do I have the right to demand a company clear all my personal data. Meanwhile we have multiple large organizations that have hemorrhaged data to the world and caused irreparable harm to individuals, with little or no consequences. We're all held hostage by tech.

swyx 4y ago

ive thought of a mitigation for this - always intentionally enter the wrong password on the first try. if you're being phished, you'll notice when the wrong password gets you in

function_seven 4y ago
I thought some phishing attacks act as a relay or middle-man? I don't know how common that is.
- coder543 4y ago
  100% correct. You might have 2 factor enabled, so they also need to check that and phish the 2FA code as well. That 2FA code expires quickly, so it needs to be used in real time to get a session. I'm sure there are some very basic phishing attacks that just save whatever you entered, but... let's avoid trying to come up with "clever hacks" that only lend a false sense of security.
eviks 4y ago
a much more convenient mitigation - create an item without a password, so it would autofill username (and not autofill if you're being phished, so domains wouldn't match), so all you'd have to do is enter the password from memory

eviks 4y ago

You can create an item without a password for this purpose - it would show an indicator if you have an account at a given domain, would even autofill the user name But you still get to save the critical password from the poor security of password managers Win Win

coder543 4y ago
> the critical password from the poor security of password managers Just because one restaurant has a bad health inspection score and is constantly making everyone who eats there sick does not mean all restaurants are bad. People who just lump "password managers" into one group are fundamentally assuming that one bad password manager means that all password managers are automatically bad, we just somehow don't know it yet. Don't bother eating at restaurants ever again if you feel that way, I guess. I know people who have gotten sick eating at restaurants, but that doesn't stop me from finding good restaurants. Most password managers have a very good security track record. Users creating and remembering their own passwords does not have a good security track record at all. Better to use a completely offline password manager (which risks you losing your backups or getting into a conflicting sync state) than no password manager at all, but a password manager that actually encrypts all your data end to end (which LastPass does not) and requires a strong key to unlock (such as the 2SKD method, which again... LastPass does not) is extremely safe, even if you don't trust "the cloud", because you don't need to trust the cloud.