466
Password manager by Amazon (lemmy.world)
submitted 1 year ago by to c/technology@lemmy.world
129 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 185 points 1 year ago (19 children)

Here's the thing .. as crazy as a notebook with passwords sounds, it's not accessible to someone across the internet.

  • permalink
  • fedilink
  • source
  • hideshow 19 child comments
    •
  • [–] 70 points 1 year ago (10 children)

    Password managers check the URL before giving its data. A human being can be fooled into giving it to a fake web site.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 40 points 1 year ago* (9 children)

    TBF, they can be fooled too.

    Bitwarden warns against using autofill on load for that very reason, as then simply loading a malicious page might cause it to provide passwords to such a site.

    And then, a human when a site doesn't autofill, is more likely to just go "huh, weird" and do it manually.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 18 points 1 year ago*

    You've always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something's wrong and back away.

    If you're already used to manually typing in the auth details, you may not even notice you're not on the site you were expecting.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 1 year ago (6 children)

    Wait, what? How does autofill get fooled?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 0 points 1 year ago (5 children)

    Someone manages to maliciously sneak username and password fields onto a site that store what is entered as soon as it's typed. They don't even have to be visible to the user and bitwarden will fill them in as soon as the page loads.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 6 points 1 year ago (4 children)

    Bitwarden will only autofill if the domain matches.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 1 year ago (3 children)

    Right, "maliciously sneak", as in they've either gained access to make changes to the site ditectly, or they've found a way to inject their scripts to steal creds.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 1 year ago* (last edited 1 year ago) (2 children)

    And how is that any different from not having a password manager?

    Yes, if someone hijacks a domain they can get credentials intended for that domain. A password manager doesn't make a huge difference here, because why would they make the site look any different than normal?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 1 year ago (1 child)

    They don't even have to be visible to the user and bitwarden will fill them in as soon as the page loads.

    I guess you didn't read most of the comment.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 year ago*

    No, he did, here's where the confusion is.

    Serinus is asking if the site in question needs to be compromised. In other words, can the attacker compromise a random site to fool your password manager into entering credentials for Gmail.com, or does the attacker have to compromise Gmail.com to do that?

    Because those two attacks are very different levels of complexity.

    And frankly, if someone compromises the site you're actually trying to visit, there's simply no defense against that at all.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago

    they can be fooled too.

    Makes it harder: when I go to the wrong website, the manager simply doesn't suggest credentials (it does not have) for it. That causes me to wonder why.

    Without a password manager, a user is never prompted to wonder. They'd simply not notice.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 1 year ago* (1 child)

    Yeah, It's actually quite a secure way to store passwords, since it requires physical access.

    I knew a guy who had a drawer full of slips of paper with passwords written on. He called it the "security drawer". Made me smile, but probably shouldn't have been advertising it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 1 year ago (2 children)

    Just maybe don't plaster "THESE ARE MY SECRETS" on the cover. Security through obscurity.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago*

    My mom had a nice little notebook for passwords. But when she passed, we couldn't find it anywhere... We went through the whole apartment, everything.

    Not having her passwords made a lot of things harder, closing her accounts, accessing her laptop, phone, etc. So while you shouldn't advertise it, do tell a few people where to find it if they need to.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago*

    INTERNET PASSWORD LOGBOOK is probably a paper slip that you can remove, and then it'll just be a blank leather journal.

    Now a REALLY secure physical logbook would just have the cover of a boring, unremarkable-looking book on the outside.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago* (last edited 1 year ago)

    but:

    1. way less convenient to generate dozens and dozens of unique, complex passwords. which means it’s less likely to be used/updated as much as it should be.

    2. not tied into MFA which is an additional layer of security and convenience

  • permalink
  • fedilink
  • source
  • parent