Hacker News Reader

Comment by ziml77 | Hacker News Reader

The native tree-style tabs in Orion (yes, actual tree-style, not just vertical) are awesome. And on my M1 MBP Orion handily beats Firefox in power efficiency.

Being able to install Chrome extensions, despite being a Webkit based browser, makes it better than Safari (where people have to pay the Apple Tax to make extensions for it).

Really there's only 2 issues I have with Orion:

1. It's not available outside of the Apple ecosystem. I want to be able to use the same browser across all my devices so everything syncs nicely.

2. 1Password refuses to whitelist Orion for their browser extension. Yes 1Password's Universal Autofill works pretty well, but that doesn't help when I'm making a new account or updating a password

I know Kagi can't do anything about #2, but I'm hoping they are actively working on #1. It would be the thing that finally makes me leave Firefox behind.

View on HN

I knew I should've come to the comments first. This is exactly where I ended up in my thought process after about 15 minutes of diving in.

The mobile version is also super buggy. Frequently when I’m using it it just turns half-black and I can’t see the page. Really love the desktop version though

Agreed on all points. It also has too many bugs for non technical/canary users. However Vlad is very open on this, both on Discord and the issue tracker (https://orionfeedback.org/).

It's an amazing browser, and I'd love to use it across all my devices.

Much of the risk associated with password managers is only applicable when using the browser extensions. I know it’s a minor inconvenience, but I would advise sticking with the lack of extension.

This hasn’t been shown to be true in any meaningful way.

I think it is if the the extension does it’s thing without any user interaction?

At least I remember reading that that was why the Bitwarden extension is so safe. It doesn’t do anything until I press a button.

Indeed - in the past, some browser extensions would auto fill into iframes and similar, using the origin identity of the page container, even when the field was invisible. That's obviously an issue, but sticking to manual actions (partly) helps there.

The downside of not using a password manager is that users enter (or paste) their passwords without any robust domain validation. In phishing scenarios, a missing auto fill prompt is likely to be enough to encourage a pause and think.

Tavis Ormandy is one of the leading security experts in the world. Here’s a blog post that highlights a number of the risks related to password manager extensions: https://lock.cmpxchg8b.com/passmgrs.html

Why won’t 1Password whitelist it?

They are a bit vague, but it usually comes down to "we don't want to manually handle it every time a new tiny browser comes by". Plenty of staff responses in here:

https://1password.community/discussion/124112/support-for-or...

Reply on news.ycombinator.com