18

How usable and secure are 3rd-party password managers like Roboform, Lastpass, and 1password from the built-in Chrome and Mozilla password managers? What are the advantages of using 3rd-party password managers over browser password managers?

The basic features of auto-fill and saving of passwords are available in both kinds (3rd-party and browser) of password managers. Passwords are stored securely and can be synced by both of them. I don't see any considerable advantage of using a third-party password manager. Am I missing something?

  • FYI: Lastpass has a desktop application as well as the browser one. – MiniRagnarok Nov 11 '14 at 18:12
13

There are three main areas of difference.

First, password management is a feature for browser developers, while it is the entire product for the third parties. So typically, the browser managers only offer basic core features. The 3rd parties add lots of useful stuff on top to differentiate their product. For example:

  • Storing other information apart from web page logins.
  • More sophisticated password generation features.
  • Checking sites against lists of breaches and warning you to change your password

Second, because 3rd party managers are not tied to the browser, there are some situations in which they are more flexible. for example:

  • You can have one password store that works with multiple browsers on your machine
  • The browser managers typically only use the browser's services for backup and sync. For example, Chrome only uses Google Sync Services, Safari only uses iCloud. If you want to use Dropbox, you have to go third party.
  • The portable/mobile versions of 3rd party managers will show you the password if required, so you can type it in on a temporary machine without having to configure the browser to sync all your passwords over and then remove them later.

Lastly, third party managers are usually targeted at the security-conscious and so usually better document their security practices and have security as higher on their list of priorities.

  • first, second and last points can be implemented easily in browsers as well. Browsers already store many information fields of a input form for a given website. Though, I agree about 3rd party managers working independently of browsers, but again browser can be made to import password and display passwords to the users. I mean how difficult is for the browser to implement this functionalities? – Curious Nov 11 '14 at 12:37
  • Re-written to address this better, I hope! – Graham Hill Nov 11 '14 at 13:01
  • Interestingly, when I switched from Chrome on Windows to Safari on OSX, I found to my surprise that all my passwords were already there. Apparently, when I installed Chrome on OSX, it synced its passwords from Google Sync to the OSX keystore, so that Safari could access them. Now that I additionally also own an Android phone and an iPad, my passwords are synced on all devices by virtue of the iPad syncing with iCloud, Android syncing with Google and both Safari and Chrome on OSX syncing with the keystore. (Leads to a lot of stale password entries, though.) – Jörg W Mittag Nov 11 '14 at 14:03
  • exactly my point, browser has or could have all the functionalities of 3rd party s/w. I am not against 3rd party managers, but I want to know 1 feature that I will look for which can't be found in browsers. Since it is the browser who displays the web page, storing information other than web page logins should be easy, actually chrome does store and fills all information. Checking site when it is breached could be done using a browser too. No comments on password generation, as I agree it is a different functionality altogether for a browser to implement. – Curious Nov 11 '14 at 14:09
  • 2
    The only noteworthy difference I find, is the storage mechanism of the saved website passwords. Browsers like chrome use Data Protection API exposed by Windows to encrypt and decrypt passwords, whereas the password managers derive key from the master password using some "Key derivation function" which increases the effort of a brute-force attack by a constant factor. – Curious Nov 11 '14 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.