Comment by dataflow | Hacker News Reader

Comment by dataflow | Hacker News Reader

Parent Full thread

> Use a password manager that fills in fields automatically

(EDIT: To everyone saying this is a bad idea: yes I agree, and that's unrelated to my question. Before reading my subsequent paragraph, note this sentence can be interpreted two different ways. I thought it meant "automatically" as in "without needing to manually copy-paste" (to avoid phishing), but it seems maybe the intention was "without prompting the user"? The second one seems like bad advice and not what I was asking about regardless - I'm asking about the anti-phishing fill where the program enters the text, NOT about unprompted filling, which I already agree is a bad idea.)

It's not this simple in reality is it? Surely it's not just me whose password manager often has to prompt to fill in a legit website it can't recognize, because the domain or URL isn't the same as what it has stored in its database? Are non-technically-inclined folks expected to be able to follow this advice in practice?

Aside from the phishing issue, which I don't find convincing anyway, auto-filling vs. copy/paste is a choice between browser extension security and clipboard security.

Personally, I use 1Password without any browser extension and I choose to copy/paste my password from the 1Password app into the password field on a website. Usually I type the username/email manually.

If my clipboard is compromised, then an attacker will get only the password for only the current website. They won't even know the username or website it's associated with.

On the other hand, if a browser extension for my password manager is compromised, the impact could be much more severe and widespread. In some scenarios an attacker could read my entire vault.

Also, if my clipboard is compromised, then probably so is my entire OS, in which case all my browser extensions are too.

This is my personal preference, but frankly I think it's just bad advice to use a browser extension with your password manager, and especially bad advice to use one with auto-filling behavior.

I turned this off. It is possible that the site gets hacked and your password manager automatically fills it in, the attacker now can read the password (via embedded javascript) that you've filled into the field without even submitting it first. By making this a manual process, it at least gives you a fighting chance.

It shouldn't matter as long as you don't reuse your password. If the site is hacked to the point where someone can inject javascript, I'd assume all of my data has already been compromised without logging in.

> I'd assume all of my data has already been compromised without logging in.

Not entirely true. If the site requires your login in order to, say, decrypt your server side data, then even if the site is compromised, your data is still secure, until you log in. I'm making this up as a possibility, I've never seen or heard of a site that actually did that.

Regardless, I'd rather error on the side of caution. There are too many things that I don't know about here that could be possible. Automatically filling in my password somewhere seems like an obvious thing to be cautious about.

> I've never seen or heard of a site that actually did that.

Protonmail maybe ;-)

That's actually a good example!

How would you know that the site's been hacked, and if you do, why would you visit it?

I don't know that the site has been hacked, that's the point. I'd rather not automatically throw my password into a form when I visit a site. It seems like a kind of obvious thing to me.

The goal of a password manager is to use random password, one generated for each website, so that if one is leaked... Well, nothing more ! So having autofill is a good feature.

Sure and I use that feature... But, you aren't thinking like a hacker.

Leaking one site could allow someone access into another site. For example, if I've integrated API keys from one site into another. It is those sorts of targets that hackers really look for.

I recently was looking into the possibility of finding a local tax prep service for the mess that is my taxes from 2020. I stumbled upon a website that was highly rated on Google and looked completely professional, so naturally I let my guard down a bit while browsing it. Before I knew it one of their navigation links in this otherwise professional looking site redirected me to some malware spewing porn site that probably would have downloaded and installed itself on my machine if I was not using uBlock Origin and on Mac. It's super easy to get tricked these days even when you are security conscious 95 percent of the time, it only takes that one 5 percent chance to go wrong.

I'm not sure I get the issue people have with autofilling passwords, instead of making the user copy and paste.

Every password manager I've used associates those credentials with a URL. One of my accounts used to get them confused, because the company offered a dedicated login page and login via the home page on separate subdomains.

So that feature might make it harder to get phished by adding friction. And if an attacker has malicious code running on the legitimate website, how would you know?

I'd suggest that auto filling is a bad idea. i have bitwarden auto fill when i use a hotkey combo. That, in my mind is safer.

For the very reason he mentions down the page :

>Use tools so you can't mess up even if you're not paying attention.

*Note its worth noting that this hotkey combo only works on sites that you have logged against that password. it wont just blurt out the next password.

Reply on news.ycombinator.com