I store all of my passwords in firefox's built-in password manager. They auto-fill into websites, sync to my phone, notify me if one appears publicly, and I can generate strong new passwords conveniently. The pw vault is stored encrypted in the cloud as far as I know, but I don't really know the technical details. I presume that it's just as secure as using a "proper" manager.

Is there a problem with not using a dedicated password manager? I used to use LastPass but then.. I stopped. And at the time I didn't see anything wrong with just sticking with FF.

Using Firefox is fine right? If so, what's the benefit of something like BitWarden/etc over the built-in one?

you are viewing a single comment's thread
view the rest of the comments
[–] 45 points 7 months ago (5 children)

Your browser constantly runs 3rd party code and through its sheer complexity has a big attack surface. Password stealers regularly use flaws or social engineering to steal browser passwords. It is simply safer to use an application whose only function it is to store passwords securely.

  • source
  • hideshow 5 child comments
  • [–] 6 points 7 months ago (3 children)

    Does this extend to also not using browser extensions for password managers?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 7 months ago* (2 children)

    Depends on the extension. If it auto-fills without interaction or caches credentials, it can be tricked into auto-filling credentials. Extensions like the one for KeePassXC only auto-fill after you clicked on the auto-fill icon.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 7 months ago (1 child)

    Interestingly, auto-filling can also be more secure than just typing in your credentials, because the extensions will only fill if the site URL matches, where as people can be tricked into thinking they are on a different site.

  • source
  • parent
  • hideshow 1 child comment