4 ms·

Well, unless there is zero integration with the browser, then it’s just a matter of time before some exploit will expose how to retrieve arbitrary information f

Well, unless there is zero integration with the browser, then it’s just a matter of time before some exploit will expose how to retrieve arbitrary information from the external tool. And of course, the external tool can have plenty of exploitable leaks unrelated to whether or not it’s integrated to some browser. If the goal is to have better security, no method of using password alone will bring significant improvement to an authentication system, no matter how great the password manager it’s used with.

graemep 2y ago
Any tool can have leaks, but integration with an application that connects to large numbers of servers over the internet seems to be a huge increase in attack surface to me, compared to a password manager that is external to the browser.
dspillett 2y ago
> Well, unless there is zero integration with the browser, then it’s just a matter of time before some exploit… Which is why my password manager has zero integration directly with the browser, or anything else for that matter. There is a tiny little bit of extra legwork caused by this⁰, but IMO it is a good compromise between convenience and easily available attack surface. ---- [0] and it might be susceptible to attacks that manage to listen to the OS message queue & clipboard where a browser integrated method would not be, but once something is that far into your system there isn't much that is going to help you except maybe an orbital nuke.
- neobrain 2y ago
  > Which is why my password manager has zero integration directly with the browser, or anything else for that matter The ideal amount of integration is actually non-zero. Manually copy-pasting passwords makes you susceptible to URL phishing, unless you also consistently copy from the browser URL bar into your password manager.
  - NotPractical 2y ago
    This is a much more likely attack scenario than browser zero days.

graemep 2y ago

Any tool can have leaks, but integration with an application that connects to large numbers of servers over the internet seems to be a huge increase in attack surface to me, compared to a password manager that is external to the browser.

dspillett 2y ago

> Well, unless there is zero integration with the browser, then it’s just a matter of time before some exploit… Which is why my password manager has zero integration directly with the browser, or anything else for that matter. There is a tiny little bit of extra legwork caused by this⁰, but IMO it is a good compromise between convenience and easily available attack surface. ---- [0] and it might be susceptible to attacks that manage to listen to the OS message queue & clipboard where a browser integrated method would not be, but once something is that far into your system there isn't much that is going to help you except maybe an orbital nuke.

neobrain 2y ago
> Which is why my password manager has zero integration directly with the browser, or anything else for that matter The ideal amount of integration is actually non-zero. Manually copy-pasting passwords makes you susceptible to URL phishing, unless you also consistently copy from the browser URL bar into your password manager.
- NotPractical 2y ago
  This is a much more likely attack scenario than browser zero days.