News for hackers. Stuff that matters.

A comment on Evaluation of five password managers. Parent comment

Re:Evaluation of five password managers by tyingq on Friday December 21, 2018 @03:35PM (#18736399)
Interesting. Browser plugins, by nature, include source code. I wonder if there's an easy fix. Can you describe the issue in a little more detail?
[ Parent | on HN ]
Re:Evaluation of five password managers by tln on Friday December 21, 2018 @05:13PM (#18737166)
Password managers usually use native messaging, ie a native helper app

https://developer.chrome.com/apps/nativeMessaging

[ Parent | on HN ]
Re:Evaluation of five password managers by paul167 on Saturday December 22, 2018 @03:55AM (#18739713)
I took a shot at building a browser plugin for 1pass [1] a little while back.

Turns out, the hardest thing is not the crypto or the browser to app communication, but parsing the HTML to accurately find the login forms. If I remember correctly, the browser plugin on Mac actually sends the entire HTML to the app for parsing. The parser is probably quite complicated and they avoid reimplementing it in extensions that way.

[1] https://medium.com/@paulsc/making-a-1password-client-15dd39a...

[ Parent | on HN ]
Re:Evaluation of five password managers by tyingq on Saturday December 22, 2018 @09:36AM (#18740721)
Of course that also protects the IP :)

Also, great post. I love reading reverse engineering stories.

[ Parent | on HN ]