4 ms·
Yes, there is a continuum of security, agreed. The correct place to draw the line is a place where the user has every convenience they want, and an attacker do
by ronaldx 13y ago
Yes, there is a continuum of security, agreed.
The correct place to draw the line is a place where the user has every convenience they want, and an attacker does not have any additional convenience.
Revealing plaintext passwords does not convenience the user but it would convenience attackers (with low skill).
- jtheory 13y ago> Revealing plaintext passwords does not convenience the user That bit is not true, with a caveat. I have a ton of low-security username/password pairs stored in FF. I find I do need to look at the plaintext passwords now & again, because I want to open one of those sites on my phone, for example, and don't remember the password (I looked up my HN password just yesterday so I could sign in on my phone, actually). Sometimes I find I've saved multiple pairs for one site, and I need to review the passwords to figure out which is valid. I've used the same feature in Thunderbird with IMAP and SMTP server passwords, when I have an email account I've been using for year w/o changing the password, and I realize I haven't saved it anywhere else. All of these are not hampered by requiring a master password, of course... I'm in agreement with timbl on his reasons not to allow just anyone to view these by default.
- baddox 13y agoBut requiring a master password certainly does inconvenience the user.