I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one.

On the one hand, installing a third-party addon to your browser comes with inherent risks, so cutting out the middle man and using a password manager made by the browser manufacturer could be seen as having less risk.

On the other hand, keeping passwords in the browser has historically been seen as very insecure (at least back when nobody encrypted them), and using a tried-and-true password manager that has had bug bounties on it for years and held up to a lot of pentesting could be advantageous, and browser manufacturers might not be specialized in the type of security necessary for password management (in-browser products might be seen as roll-your-own solutions).

Are there any risks I'm missing? What might (or 'does' if you would like to speak to this specific case) mitigate the risks?

  • Personally I think it's good architecture to separate them. Most password manager vulns have been related to autofill. If they prompted the user before autofill, that would fix most problems. – paj28 Aug 12 '19 at 17:10
  • 2
    Are you asking if the browser manufacturers should offer password managers, or are you asking if you (as a user) should choose a browser's password manager over a third party password manager? – John Deters Aug 12 '19 at 21:14
  • both, but mainly the latter. – NH. Aug 15 '19 at 17:48

I assume you are asking if you (the user NH) should trust a browser's built-in password manager, or if you should install a third party plugin; and not whether or not Mozilla should develop another password manager.

Before I get started, keep in mind that security isn't just about vulnerabilities or architecture or protocols or passwords; it's an overall idea that you (NH) depend on to protect yourself.

Now, consider that every browser's password manager is almost always specific to that browser, and that browser only. To use your example, Lockwise will sync and auto-fill passwords in Firefox on your desktop at home, in Firefox on your laptop, in Firefox on your iPhone, and in Firefox on your Android phone. But it will not enter passwords in Safari on your iPhone, or Chrome on your Android phone. It is not (yet) a general password manager that will enter passwords for your other apps on your phones, or laptops.

Third party password managers have a different objective. They attempt to offer as many integrations to apps, operating systems, and browsers as possible so they can truly provide a single keyring.

Virtually all third-party password managers offer browser plug-in components. Many applications offer integration for authentication plugins. And for those systems where nothing is offered, most desktop versions of password managers can still use phantom fingers to auto-type your credentials into whatever application windows need them. Also note that some modern password managers can now replace your iOS keyring, so all your iPhone credentials are managed in the same externally managed database.

So why did I start this by mentioning your overall security? Because if your password manager doesn't manage every single one of your passwords, as a human you are still likely to choose easy-to-type passwords whenever your credentials are shared across applications or platforms that aren't supported by your password manager. Choosing "p@ssword" or "12345" for those occasions where your browser's tool doesn't work will likely increase your overall security risks far more than a browser-based password vulnerability.

So in the overall picture, it seems that the most important security attribute of any password manager is the ability to integrate with the greatest number of your own platforms and applications. Maybe Lockwise will do this some day, and you'll be able to use it with Firefox, Safari, Edge, Chrome, Opera, Windows, MacOS, iOS, Android, and Linux. But for now, it seems that third party password managers offer the best overall integration options, which should provide you with the most overall protection.

| improve this answer | |
  • +1 but why not just use firefox everywhere? – Vipul Nair Aug 12 '19 at 23:00
  • 1
    Because my burglar alarm app has a password, my garage door app has a password, my ownCloud app has a password, and about 30 different phone apps all have passwords that are only exposed to the iOS UI. I currently use the Apple key ring to manage them. It doesn’t sync to Firefox. They all sync to Bitwarden, however, so that’s what I use – John Deters Aug 12 '19 at 23:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.