Hacker News Reader

Comment by pinusc | Hacker News Reader

1. Is not necessarily true. If you use an open source browser like firefox, your browser vendor would absolutely not be able to access your passwords (...without creating a huge scandal where users would catch up immediately)

3. Can actually be mitigated, or other options can be used. For example, in my browser I disabled JavaScript clipboard access, so that random websites can't access my passwords. You mention pass, aan excellent non cloud option, which I personally use with a script that types in the password as if it was a keyboard - but Firefox and chrome plugins with autofill are available, and those are offline.

View on HN

Your browser sends and receives tons of packets to addresses owned by the browser vendor and third party sites. After all that's its main function. Your open source browser is millions of lines of code. You think it would not be possible to exfiltrate passwords without your notice? It seems a much more practical approach to assume your browser vendor is a "good guy", as the alternative model is that you choose to do all your most sensitive computing via an adversary.

I think the premise is we would know if it already did that, and incremental code changes can be inspected to see it isn't added. So yeah, it's pretty safe to say open source makes it trustable.

That's pretty reasonable, but if I were a malicious actor looking to do something like this, I'd try to introduce different bugs at different times that combine to leak passwords. That would give plausible deniability, too. Not saying it's an easy scheme to engineer.

People inspect chrome diffs for weird changes too. Closed source software does not prevent people from noticing malware, especially in some of the most heavily scrutinized software in the world.

Regarding point 3, my point really is that just a command-line program is not enough. I need a browser plugin or a keyboard emulator. That's one more piece of software, possibly from another vendor (see point 2). But yes, you're right, using the clipboard is not required for any reasonable password manager. It just might be an easier way sometimes.

Also it's quite difficult to keep up with all the apps on my system and all of them can follow the clipboard. I didn't even consider random websites.

1. Is most certainly true. Everything you type needs to be entered, and your browser probably has undo/repeat, which means a stack of your text is available too, it's still an application at the end of the day

Reply on news.ycombinator.com