466
Password manager by Amazon (lemmy.world)
submitted 1 year ago by to c/technology@lemmy.world
129 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 40 points 1 year ago* (9 children)

TBF, they can be fooled too.

Bitwarden warns against using autofill on load for that very reason, as then simply loading a malicious page might cause it to provide passwords to such a site.

And then, a human when a site doesn't autofill, is more likely to just go "huh, weird" and do it manually.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 18 points 1 year ago*

    You've always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something's wrong and back away.

    If you're already used to manually typing in the auth details, you may not even notice you're not on the site you were expecting.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 1 year ago (6 children)

    Wait, what? How does autofill get fooled?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 0 points 1 year ago (5 children)

    Someone manages to maliciously sneak username and password fields onto a site that store what is entered as soon as it's typed. They don't even have to be visible to the user and bitwarden will fill them in as soon as the page loads.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 6 points 1 year ago (4 children)

    Bitwarden will only autofill if the domain matches.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 1 year ago (3 children)

    Right, "maliciously sneak", as in they've either gained access to make changes to the site ditectly, or they've found a way to inject their scripts to steal creds.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 1 year ago* (last edited 1 year ago) (2 children)

    And how is that any different from not having a password manager?

    Yes, if someone hijacks a domain they can get credentials intended for that domain. A password manager doesn't make a huge difference here, because why would they make the site look any different than normal?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 1 year ago (1 child)

    They don't even have to be visible to the user and bitwarden will fill them in as soon as the page loads.

    I guess you didn't read most of the comment.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 year ago*

    No, he did, here's where the confusion is.

    Serinus is asking if the site in question needs to be compromised. In other words, can the attacker compromise a random site to fool your password manager into entering credentials for Gmail.com, or does the attacker have to compromise Gmail.com to do that?

    Because those two attacks are very different levels of complexity.

    And frankly, if someone compromises the site you're actually trying to visit, there's simply no defense against that at all.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago

    they can be fooled too.

    Makes it harder: when I go to the wrong website, the manager simply doesn't suggest credentials (it does not have) for it. That causes me to wonder why.

    Without a password manager, a user is never prompted to wonder. They'd simply not notice.

  • permalink
  • fedilink
  • source
  • parent