Hacker News Reader

Comment by scraft | Hacker News Reader

I signed up for something recently and on the password screen it popped up with something along the lines of "Hey, can we generate a secure password for you, don't worry, your browser will remember it for you?" I said yes, sure enough a strong password appeared and Chrome offered to remember it. Seemed like a nice introduction to using secure passwords. The next thing I signed up for I manually generated a secure password and pasted it in and that is now stored in my browser too.

View on HN

And now that person is forever locked in to the browser they were using at sign up time. What happens if they move from Mac → Windows or Android → iOS?

As long as they use the same browser on each of those platforms, they're good.

Yes, vendor lock-in is an issue; and I hope eventually there'll be a way to sync credentials across browsers. But keep in mind that, even as things are now, it only locks you to a specific browser, not to a specific OS.

Exporting the passwords is also possible, so it's not really much lock-in. Not to the kind of person who'd care, and want to switch browsers.

You got it backwards. Vendor lock-in rarely applies to experts. It is the people who "don't care" that _we_ should care about protecting from lock-in. After all, that is how we got internet explorer 6.

Those, in my experience, are the same people who can't switch browsers. They aren't capable of learning new things, and can often barely keep going with what they have.

Not in my experience. They are the people who just don't care. What they have works well enough, so they don't look to change it.

Good point—anyone using Chrome is good. I was thinking of people who are using Safari or Edge, which aren't available on other platforms.

Assuming your browser syncs passwords, etc.

I know a ton of people who use Chrome on non-mobile and Safari on mobile.

I think most browsers can import most information from most other browsers at this point.

Or use more than one device to login?

All major browsers can sync their passwords across their desktop and mobile versions. I use Firefox Sync on two laptops, one desktop and an Android phone.

I was unaware that Firefox / Chrome can own all your passwords in their cloud.

Not sure about Chrome, but Firefox encrypts everything on the client before syncing, they only see blobs of bytes. Plus you can run your own Sync server.

Ancient reply, but...

Even if Firefox "encrypts" before syncing, they must decrypt in order to provide the clear text password from another browser, no? They don't send "blobs of bytes" to password form entries.

Most browsers still don't have a second line of defense (like password managers do), correct? So, if a user has access to my browser for two mins, they can see all my passwords in plain text. They can't if my passwords are in password managers which will ask for my master password. I never understood why browsers didn't give an option to have a bit more security with those passwords. Just let the user enter one master password before they can see their stored passwords.

Do you remember the URL of this website?

Reply on news.ycombinator.com