New answers tagged password-management
2
As ThoriumBR states, yes the browser extensions should validate the domain and only fill the credentials if the domain matches.
It is way better to let the browser extension fill the credentials than using some "auto-type" shortcut that only matches the windows name to type the credentials... the latter cannot validate the domain properly and will ...
3
They validate the domain. It's an information the browser gives the extension, the extension checks its database to see if that domain have saved credentials, and only autofills it if there's an entry on the database.
There were some cases when a password manager got tricked into providing credentials to the wrong domain, but those cases are rare and they ...
1
A good way to think about this is with a threat model.
You've got a set of assets to protect. Those assets can be roughly grouped into two levels of risk. Risk is calculated by the likelihood of an attacker going after that asset, multiplied by the impact or cost that would occur if they compromised that asset.
You access those assets from your computer, ...
1
Certainly a valid approach to take - there was a good Microsoft whitepaper once making exactly this point - but my own feeling is that it is a waste of mental bandwith trying to decide how important a site is, and then later remembering how you signed in to it.
I use my password manager for everything and 99% of the time it pastes the password in for me and ...
4
The main way that OTPs are weaker than regular passwords is that they need to be made available to the user through some method, before the user has authenticated. There are a few ways to do this, with widely varying security. For example, SMS is very weak - it's considered weak even for a second factor, so using is the only factor is extremely poor security ...
1
OTP is indeed a lot more secure than regular passwords. However, one example that I could counter that would be "What if you lost your device?" How would you prove that it is you who are the one that has the access to the account? How would you prove to the other programs, such as your email, telling that it's you who's trying to log into your ...
0
Enabling the YubiKey feature doesn't help if the attacker is capable of sniffing USB packets or inspecting memory.
It does help with a far more common scenario: Someone somehow obtained a copy of your encrypted password database but they don't have access to your computer or YubiKey. (Maybe someone found your lost thumb drive containing a copy. Or maybe ...
1
Password managers manage passwords. So all the weaknesses you have seen will exist because they simply manage the strings.
What you want is an access manager. You want something where the PA logs into, but then gains access to the service under the Manager's account. This way, the access manager manages the password, not the user. It is then also possible to ...
2
If the 1Password website were somehow already compromised when I
created an account, couldn't an attacker have the info they need from
me now to decrypt my data, or am I missing something?
YES. And not only would you be vulnerable to this type of attack when you create your account – but, you would be vulnerable to this type of attack any time you login in ...
Top 50 recent answers are included