News for hackers. Stuff that matters.
Re:Browser Extension Password Managers Exposing Passwords Ev... by HaloZero on Friday December 20, 2013 @09:30PM (#6945429)
I honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build that feature because it exposes issues like this.
Re:Browser Extension Password Managers Exposing Passwords Ev... by neltnerb on Friday December 20, 2013 @11:04PM (#6945689)
What's the alternative? Generate randomized passwords and memorize them all? I have 250+ passwords for different websites, and not a great deal of choice about it. This is certainly way better than the actual likely alternative -- using the same password on all 250+ sites.
Re:Browser Extension Password Managers Exposing Passwords Ev... by blazingice on Saturday December 21, 2013 @04:10AM (#6946242)
1Password's browser extension v4, in contrast, fills in the form only when you press a key combination (⌘-\ on OSX), and has you enter your master password into a dropdown from the OSX Menu Bar, and not inside the browser frame. Pretty snazzy all around.
Re:Browser Extension Password Managers Exposing Passwords Ev... by neltnerb on Saturday December 21, 2013 @08:20AM (#6946596)
Aha, I see the distinction now. Thanks. Enough to simply disable autofill in LastPass then? I'm loathe to learn a new system because of such a seemingly small size vulnerability.

LastPass has me enter the master password in a pop up window when I click on the icon from the extension (firefox/chrome), although I suppose that's maybe not as good as an independent application?

Re:Browser Extension Password Managers Exposing Passwords Ev... by korg250 on Saturday December 21, 2013 @09:26AM (#6946715)
Exactly.

I can, not only disable autofill in the Lastpass configuration, but also set to require password reprompt for any of my credentials. I could also individually disable autofill for any credential.

Please should first know how something works before criticizing.

Re:Browser Extension Password Managers Exposing Passwords Ev... by toast0 on Saturday December 21, 2013 @01:03AM (#6945953)
Just because there's no autofill doesn't mean you don't have a password manager.
Re:Browser Extension Password Managers Exposing Passwords Ev... by jpgoldberg on Saturday December 21, 2013 @01:53PM (#6947519)
[Disclosure: I work for AgileBits, the makers of 1Password]

In 1Password 4, there is no auto-filling. People can use Ctrl-\ or Cmd-\ to tell 1Password to "fill this page". In versions prior to 4, auto-fill was an option. (I'm not sure which versions had what defaults.)

Re:Browser Extension Password Managers Exposing Passwords Ev... by HaloZero on Sunday December 22, 2013 @01:22PM (#6951081)
Oh I know. I use 1Password. I forgot to mention that your solution works better but I believe blazingice mentioned it above.