5 ms·

I honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build th

I honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build that feature because it exposes issues like this.

neltnerb 13y ago
What's the alternative? Generate randomized passwords and memorize them all? I have 250+ passwords for different websites, and not a great deal of choice about it. This is certainly way better than the actual likely alternative -- using the same password on all 250+ sites.
- toast0 13y ago
  Just because there's no autofill doesn't mean you don't have a password manager.
- blazingice 13y ago
  1Password's browser extension v4, in contrast, fills in the form only when you press a key combination (⌘-\ on OSX), and has you enter your master password into a dropdown from the OSX Menu Bar, and not inside the browser frame. Pretty snazzy all around.
  - neltnerb 13y ago
    Aha, I see the distinction now. Thanks. Enough to simply disable autofill in LastPass then? I'm loathe to learn a new system because of such a seemingly small size vulnerability. LastPass has me enter the master password in a pop up window when I click on the icon from the extension (firefox/chrome), although I suppose that's maybe not as good as an independent application?
    - korg250 13y ago
      Exactly. I can, not only disable autofill in the Lastpass configuration, but also set to require password reprompt for any of my credentials. I could also individually disable autofill for any credential. Please should first know how something works before criticizing.
jpgoldberg 13y ago
[Disclosure: I work for AgileBits, the makers of 1Password] In 1Password 4, there is no auto-filling. People can use Ctrl-\ or Cmd-\ to tell 1Password to "fill this page". In versions prior to 4, auto-fill was an option. (I'm not sure which versions had what defaults.)
- HaloZero 13y ago
  Oh I know. I use 1Password. I forgot to mention that your solution works better but I believe blazingice mentioned it above.

neltnerb 13y ago

What's the alternative? Generate randomized passwords and memorize them all? I have 250+ passwords for different websites, and not a great deal of choice about it. This is certainly way better than the actual likely alternative -- using the same password on all 250+ sites.

toast0 13y ago
Just because there's no autofill doesn't mean you don't have a password manager.
blazingice 13y ago
1Password's browser extension v4, in contrast, fills in the form only when you press a key combination (⌘-\ on OSX), and has you enter your master password into a dropdown from the OSX Menu Bar, and not inside the browser frame. Pretty snazzy all around.
- neltnerb 13y ago
  Aha, I see the distinction now. Thanks. Enough to simply disable autofill in LastPass then? I'm loathe to learn a new system because of such a seemingly small size vulnerability. LastPass has me enter the master password in a pop up window when I click on the icon from the extension (firefox/chrome), although I suppose that's maybe not as good as an independent application?
  - korg250 13y ago
    Exactly. I can, not only disable autofill in the Lastpass configuration, but also set to require password reprompt for any of my credentials. I could also individually disable autofill for any credential. Please should first know how something works before criticizing.

jpgoldberg 13y ago

[Disclosure: I work for AgileBits, the makers of 1Password] In 1Password 4, there is no auto-filling. People can use Ctrl-\ or Cmd-\ to tell 1Password to "fill this page". In versions prior to 4, auto-fill was an option. (I'm not sure which versions had what defaults.)

HaloZero 13y ago
Oh I know. I use 1Password. I forgot to mention that your solution works better but I believe blazingice mentioned it above.