Re:Browser Extension Password Managers Exposing Passwords Ev...
by HaloZero on Friday December 20, 2013 @09:30PM
(#6945429)
I honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build that feature because it exposes issues like this.
[ Parent
| on HN ]
Re:Browser Extension Password Managers Exposing Passwords Ev...
by neltnerb on Friday December 20, 2013 @11:04PM
(#6945689)
What's the alternative? Generate randomized passwords and memorize them all? I have 250+ passwords for different websites, and not a great deal of choice about it. This is certainly way better than the actual likely alternative -- using the same password on all 250+ sites.
Re:Browser Extension Password Managers Exposing Passwords Ev...
by blazingice on Saturday December 21, 2013 @04:10AM
(#6946242)
1Password's browser extension v4, in contrast, fills in the form only when you press a key combination (⌘-\ on OSX), and has you enter your master password into a dropdown from the OSX Menu Bar, and not inside the browser frame. Pretty snazzy all around.
Re:Browser Extension Password Managers Exposing Passwords Ev...
by neltnerb on Saturday December 21, 2013 @08:20AM
(#6946596)
Aha, I see the distinction now. Thanks. Enough to simply disable autofill in LastPass then? I'm loathe to learn a new system because of such a seemingly small size vulnerability.
LastPass has me enter the master password in a pop up window when I click on the icon from the extension (firefox/chrome), although I suppose that's maybe not as good as an independent application?
Re:Browser Extension Password Managers Exposing Passwords Ev...
by korg250 on Saturday December 21, 2013 @09:26AM
(#6946715)
Exactly.
I can, not only disable autofill in the Lastpass configuration, but also set to require password reprompt for any of my credentials. I could also individually disable autofill for any credential.
Please should first know how something works before criticizing.
Re:Browser Extension Password Managers Exposing Passwords Ev...
by toast0 on Saturday December 21, 2013 @01:03AM
(#6945953)
Just because there's no autofill doesn't mean you don't have a password manager.
Re:Browser Extension Password Managers Exposing Passwords Ev...
by jpgoldberg on Saturday December 21, 2013 @01:53PM
(#6947519)
[Disclosure: I work for AgileBits, the makers of 1Password]
In 1Password 4, there is no auto-filling. People can use Ctrl-\ or Cmd-\ to tell 1Password to "fill this page". In versions prior to 4, auto-fill was an option. (I'm not sure which versions had what defaults.)