0

For Enterprise, how to know if Edge Password AutoSave is less secure than copy/paste to a desktop password manager which is open source?

IMHO Edge should be more secure because:

  1. copy/paste has security drawbacks
  2. Edge (Enterprise grade) update is in general more frequent
  3. Proprietary
  4. Edge's database is in the cloud while a desktop app can be copied to an external device

EXAMPLE

Is a password in the clipboard vulnerable to attacks?

Before asking IT to re-enable the Edge Passwords feature, I need expert support.

2
  • why copy/paste from the browser to the password manager? Do it the other way around and the password manager will clear the clipboard. Frequency of update is entirely up to the app, which can be frequent - how it is funded is not a factor. Why is "proprietary" a security feature? Edge's password can also be exported and moved to another device. So, I'm not sure that any of your points are valid.
    – schroeder
    Aug 23, 2023 at 6:44
  • Please don't add answers to a question. And you've never addressed my questions. And you never explained what your threat scenario was to define "more secure". If your threat scenario is physical theft, then copy/paste is irrelevant...
    – schroeder
    Aug 25, 2023 at 8:44

1 Answer 1

2

This question hinges on some false premises:

  • Product 'X' is less secure than copy/paste to a desktop password manager.
  • Copy/paste has security drawbacks.
  • Product 'X' update is in general more frequent
  • Proprietary
  • Product 'X''s database is in the cloud while a desktop app can be copied to an external device

I will address them here:

  • Modern Password desktop password managers all have some way to secure the clipboard. typically by only exposing the credentials for a short time.
  • The better ones have other means of communicating the password to the browser that do not use the clipboard at all, such as Keepass XC's browser plugin does.
  • Update frequency does not convey quality at all, Open source products are also updated frequently. No updates in a long time (more than a year) would be worrying, especially if there are CVE's published but not addressed.
  • Proprietary just means people can not check the validity of the security product. Kerckhoffs's principle even states that a secure system is secure even when everything but the secret key is publicly known (something open source products all do).
  • the cloud is just a word that means someone else's computer. a good product would use a encrypted storage that you can securely duplicate to many places without risks, and having your own independent copy of the storage means you can still access the secrets even when the company goes offline (or bankrupt).

As with anything in security, whether something is "fit for purpose" or even "better" than another option depends on what your threat model is.

which risks are you trying to mitigate, or even illuminate and at what costs. it is impossible for anyone to just tell you between the 2 options you have given, which one is better...

but I do hope you now have some better ideas how to approach the problem, and are better aware of what is and isn't a factor.

3
  • Thanks LvB, reason of my post is I prefer to use Edge password features and wonder if my computer can be an exception if reason for disabling password feature is typical laptop environment includes unprotected premise such as home or cafe; my computer stays locked in protected premise (company office - not home office); so I am hoping IT can enable password feature for Edge in my computer. Aug 24, 2023 at 3:52
  • to add more details, browser plug-in did not come installed and my request for it is still unanswered (IT); which adds extra effort (copy/paste) and creates more security risk. Aug 24, 2023 at 3:57
  • from theft standpoint, I believe Edge surpass Desktop App when computer is restricted access outside protected premise which is my company office, thus preventing copy password database to a external device. Aug 24, 2023 at 4:01

Not the answer you're looking for? Browse other questions tagged .