30 ms·

OK I'll bite ... why should I not use my browser's built in pw manager? (e.g. Safari on OS X Mavericks) I can see an argument about cross-platform use but is t

by plg 13y ago

OK I'll bite ... why should I not use my browser's built in pw manager? (e.g. Safari on OS X Mavericks) I can see an argument about cross-platform use but is there another reason or reasons? thanks,

philwebster 13y ago
There are some sites that try to disable the ability to save passwords and 3rd party password managers usually override this. Another thing that's really nice is having the LastPass extension on Firefox, Chrome, and Safari on the same computer and not having to worry about if they are using the system keychain or not. In my experience, form filling with credit card information has been less error prone with LastPass as well. I thought at one point Safari was requiring the CVV number to be manually entered too. I could be mistaken.
kijin 13y ago
I don't know about Safari, but the built-in password manager in most browsers are very light on features and have abysmal security. AFAIK Chrome still refuses to let you set a master password to protect your other passwords. Firefox is better, but the user interface is bare bones compared to a dedicated password manager. I suspect that the password manager in most browsers have received less attention than it deserves, partly because all the vendors been trying very hard to get people to drop passwords altogether. Mozilla pushed Persona, Google pushed Google accounts, Microsoft pushed Microsoft accounts. I wonder if Mozilla will start paying attention to the password manager now that it has given up on Persona. LastPass et al. have a lot of additional features that make a lot of sense once you accept that you'll be stuck with dozens of passwords for the foreseeable future. For example, LastPass offers to generate a random password for each site, recognizes when you change your password, helps you organize websites into categories, and alerts you to weak passwords.
deleted 13y ago
[deleted]
kingnight 13y ago
The OS X Keychain, which is used by Safari, can be cracked via John The Ripper.
- tlrobinson 13y ago
  *for some definition of "can be cracked"
awip 13y ago
This is why: http://raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html http://raidersec.blogspot.com/2013/06/how-browsers-store-you... TL;DR Firefox with a strong master password was considered safe at the time of that article's writing (June 2013). That + Firefox Sync is what I use - I would also be interested in anything more up to date on why this is or isn't a good idea.
- claudius 13y ago
  It’s not the job of the browser to secure your data against OS-level adversaries, that’s the job of the OS (e.g. by using file permissions to protect against other users and ideally also MAC to protect against other software). It’s not even the responsibility of the browser to protect against someone else walking up to your computer while you’re using the toilet, that’s the job of the screensaver. It is, however, the browser’s job to protect your passwords against other websites and the like, and I would be worried if there were bugs in that area, but your link doesn’t say anything about them (note also that using a password manager with an extension for protection against someone taking over the browser is useless, as that someone also owns the extension and hence can impersonate it towards the seperate password manager).

by plg 13y ago

OK I'll bite ... why should I not use my browser's built in pw manager? (e.g. Safari on OS X Mavericks) I can see an argument about cross-platform use but is there another reason or reasons? thanks,

philwebster 13y ago

There are some sites that try to disable the ability to save passwords and 3rd party password managers usually override this. Another thing that's really nice is having the LastPass extension on Firefox, Chrome, and Safari on the same computer and not having to worry about if they are using the system keychain or not. In my experience, form filling with credit card information has been less error prone with LastPass as well. I thought at one point Safari was requiring the CVV number to be manually entered too. I could be mistaken.

kijin 13y ago

I don't know about Safari, but the built-in password manager in most browsers are very light on features and have abysmal security. AFAIK Chrome still refuses to let you set a master password to protect your other passwords. Firefox is better, but the user interface is bare bones compared to a dedicated password manager. I suspect that the password manager in most browsers have received less attention than it deserves, partly because all the vendors been trying very hard to get people to drop passwords altogether. Mozilla pushed Persona, Google pushed Google accounts, Microsoft pushed Microsoft accounts. I wonder if Mozilla will start paying attention to the password manager now that it has given up on Persona. LastPass et al. have a lot of additional features that make a lot of sense once you accept that you'll be stuck with dozens of passwords for the foreseeable future. For example, LastPass offers to generate a random password for each site, recognizes when you change your password, helps you organize websites into categories, and alerts you to weak passwords.

deleted 13y ago

[deleted]

kingnight 13y ago

The OS X Keychain, which is used by Safari, can be cracked via John The Ripper.

tlrobinson 13y ago
*for some definition of "can be cracked"

awip 13y ago

This is why: http://raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html http://raidersec.blogspot.com/2013/06/how-browsers-store-you... TL;DR Firefox with a strong master password was considered safe at the time of that article's writing (June 2013). That + Firefox Sync is what I use - I would also be interested in anything more up to date on why this is or isn't a good idea.

claudius 13y ago
It’s not the job of the browser to secure your data against OS-level adversaries, that’s the job of the OS (e.g. by using file permissions to protect against other users and ideally also MAC to protect against other software). It’s not even the responsibility of the browser to protect against someone else walking up to your computer while you’re using the toilet, that’s the job of the screensaver. It is, however, the browser’s job to protect your passwords against other websites and the like, and I would be worried if there were bugs in that area, but your link doesn’t say anything about them (note also that using a password manager with an extension for protection against someone taking over the browser is useless, as that someone also owns the extension and hence can impersonate it towards the seperate password manager).