Hacker News Reader

Comment by eloeffler | Hacker News Reader

A very nice addition to i3 is pass, the paswordmanager which comes with passmenu that lets you read and autotype passwords with dmenu.

View on HN

I never, ever use these autotyping features; they are a security risk.

Is my paranoia justified?

As far as I can assess this, I believe it is safer to do this instead of copying to the clipboard. The clipboard might be read by a malicious process while autotype with passmeni will only pipe the password to xdotool and that will generate keystrokes. it's only important to have the correct field selected before autotyping or you might end up googling your password :)

A malicious process could also do many other things. I think the most likely vector for autotyping attacks is simple phishing / clickjacking.

For general readers: Its pretty safe when done via a browser plugin to a website because the plugin both verifies the website (anti-phishing) and uses auto-fill rather than type (it directly injects into the target field rather than typing, so clickjacking isn't a risk).

Its rare that I use passwords outside of the browser now, but windows and mac allow system credentials to mitigate the same risks for desktop apps (the app must support it).

True, but wouldn't that apply to manual password entry as much?

I use both browserpass, and pass and consider the pass+dmenu model to be more secure. I keep auto-fill disabled on the browserpass extension, and recommend doing the same for any password manager.

Mainly because bugs in browser extensions have led to easily exploitable bugs where the extension could be tricked into thinking it was filling the password for google.com, while the page wasn't actually google.com (dubbed Auto-fill sweep attacks on pg25 at https://aaltodoc.aalto.fi/bitstream/handle/123456789/27984/m...)

I don't think so.

https://security.stackexchange.com/a/171916/257701

The link says you should not use the autotype, but use the browser password manager instead.

Reply on news.ycombinator.com