Re:Making an SSH client the hard way
by ipaddr on Thursday October 27, 2022 @09:18PM
(#33366317)
A browser extension cannot access your email or password manager. But it can use this new security hole created by tailscale.
[ Parent
| on HN ]
Re:Making an SSH client the hard way
by yjftsjthsd-h on Thursday October 27, 2022 @09:39PM
(#33366475)
If the extension in question has the read/modify all websites permission, why would it not be able to access your email or password manager?
Who's using extensions in a work context anyway? I only use an ad-blocker because it's safer from a malware perspective.
Re:Making an SSH client the hard way
by throwawaaarrgh on Friday October 28, 2022 @12:51AM
(#33367801)
> Who's using extensions in a work context anyway?
literally everyone?
Re:Making an SSH client the hard way
by francislavoie on Friday October 28, 2022 @03:17AM
(#33368550)
React Developer Tools, for example.
Ah, thanks. I'm more on sysadmin side for my day job, and didn't even know about this. I'll have to keep it in mind as I've been dabbling with learning a modern web framework and React was a candidate.
Re:Making an SSH client the hard way
by KAMSPioneer on Friday October 28, 2022 @04:51AM
(#33369126)
Not OP, but...my email and password managers are not websites. I have a local app that does email, I have a local app that does password management. So the extension could certainly access passwords I put into my browser, but I don't see a vector to the "keys to the kingdom" so to speak.
The most popular password managers (1Password, Bitwarden, Lastpass) have a web UI.
Re:Making an SSH client the hard way
by KAMSPioneer on Friday October 28, 2022 @02:37PM
(#33375537)
Sure, and I use Bitwarden. I just don't use the web UI, specifically to avoid issues like malicious extensions, Firefox exploits, etc.
I'm aware that web-based email and credential managers exist, but GP asked "...why would it not be able to access your email or password manager?" I answered that, with my app choice, I don't see how they could.