Re:Not Getting Hacked
by TechBro8615 on Friday December 23, 2022 @02:02AM
(#34103030)
Aside from the phishing issue, which I don't find convincing anyway, auto-filling vs. copy/paste is a choice between browser extension security and clipboard security.
Personally, I use 1Password without any browser extension and I choose to copy/paste my password from the 1Password app into the password field on a website. Usually I type the username/email manually.
If my clipboard is compromised, then an attacker will get only the password for only the current website. They won't even know the username or website it's associated with.
On the other hand, if a browser extension for my password manager is compromised, the impact could be much more severe and widespread. In some scenarios an attacker could read my entire vault.
Also, if my clipboard is compromised, then probably so is my entire OS, in which case all my browser extensions are too.
This is my personal preference, but frankly I think it's just bad advice to use a browser extension with your password manager, and especially bad advice to use one with auto-filling behavior.
Personally, I use 1Password without any browser extension and I choose to copy/paste my password from the 1Password app into the password field on a website. Usually I type the username/email manually.
If my clipboard is compromised, then an attacker will get only the password for only the current website. They won't even know the username or website it's associated with.
On the other hand, if a browser extension for my password manager is compromised, the impact could be much more severe and widespread. In some scenarios an attacker could read my entire vault.
Also, if my clipboard is compromised, then probably so is my entire OS, in which case all my browser extensions are too.
This is my personal preference, but frankly I think it's just bad advice to use a browser extension with your password manager, and especially bad advice to use one with auto-filling behavior.