Master password in Firefox or Thunderbird? Do not bother

Re:Master password in Firefox or Thunderbird? Do not bother by vortico on Saturday March 10, 2018 @09:12PM (#16561345)

The author admitted the stronger-than-needed title in the first comment, but I'd like to make it clear when talking about practical personal security:

There are ~100,000 people in the world that would think to run a GPU password cracker on your Firefox master password hash, if they had access and wanted to snoop.

There are ~1,000,000,000 people that would think to open your browser and go to a website you use to try to gain access to it.

In some sense, although it's hard to quantify security, using a master password is 10,000x more effective than not.

[ Parent | on HN ]

Re:Master password in Firefox or Thunderbird? Do not bother by pzxc on Saturday March 10, 2018 @10:11PM (#16561518)

The alternative is not to give up on password management completely, but to use a proper password manager like KeePass.

[ Parent | on HN ]

Re:Master password in Firefox or Thunderbird? Do not bother by zitterbewegung on Sunday March 11, 2018 @12:22AM (#16561811)

What if you took Firefox or chrome and replaced the password manager with a keepass compatible system by default and kept the usability?

[ Parent | on HN ]

Re:Master password in Firefox or Thunderbird? Do not bother by fyfy18 on Sunday March 11, 2018 @04:10AM (#16562155)

If password managers are going to become popular for end users it needs to be something that’s built into the browser and interopable. I’d love to see this turned into a standard that all browser and device manufacturers (when I log into an app on my phone the password manager should be integrated) can implement.

[ Parent | on HN ]

Re:Master password in Firefox or Thunderbird? Do not bother by ailox on Sunday March 11, 2018 @05:42AM (#16562346)

As long as there is no default support for keepass, maybe kee/keefox will fit the bill?

https://addons.mozilla.org/de/firefox/addon/keefox/

[ Parent | on HN ]

Re:Master password in Firefox or Thunderbird? Do not bother by unsignedint on Saturday March 10, 2018 @11:33PM (#16561707)

I agree with you on this one, KeePass is way to go compared to relying on browser's password manager.

Only wish these password management functionalities (not tool itself, but whole mess switching back and forth between target app/password manager) are more pleasing than the way it is now on mobile...

[ Parent | on HN ]

Re:Master password in Firefox or Thunderbird? Do not bother by cdancette on Sunday March 11, 2018 @05:18AM (#16562287)

Android 8 provides an autofill API for this purpose! But it's only working in apps, not in the browser

[ Parent | on HN ]

Re:Master password in Firefox or Thunderbird? Do not bother by palant on Sunday March 11, 2018 @01:19PM (#16563809)

I am all for using a better password manager. In fact, with PfP: Pain-free Passwords I developed one myself - and I invested much thought into making sure the master password cannot realistically be guessed unless it is absolutely trivial. However, most people will go with whatever is built in. So no excuses for browser makers to offer something that has been known to be very suboptimal for at least nine years.

[ Parent | on HN ]

Re:Master password in Firefox or Thunderbird? Do not bother by palant on Sunday March 11, 2018 @01:47PM (#16563952)

Well, the software to crack Firefox master passwords is there for anybody to download. Maybe not quite as well optimized as hashcat with a GPU but it's easy enough to use that plenty of people might decide to try it out.

[ Parent | on HN ]