Firefox 2/IE7: Beware Of Using Password Manager

the real lesson is dont be lazy and use password managers for passwords that are vital. You wouldnt write the password down on your desk, or in a text folder, so why have the computer remember.

Comment/Reply (w/o sign-up)

I honestly don't use the password manager...I feel it compromises security too much. If 'wasting' 1-3 seconds typing in your password is too much work, I don't know what's anyones problem. Technology is great, but something as trivial as this are making people lazy. Nothing is more safe than your brain.

Comment/Reply (w/o sign-up)

I don't think I used FF or IE password managers, so when you visit a site the password manager logs you in automatically? what if I don't want to login or something? But still, when I browse with FF or IE when filling the form like my username is quatrux, I just press q and it offers me to paste quatrux, when I just push the tab button and it inserts my password, only when I press enter or the submit button by myself.. Or I just don't get something about it? What is the difference if you write it down with your hand on a "bad" site login page, or the browser will?

 

 

 

Comment/Reply (w/o sign-up)

Well, from what I've understood, Opera pastes the username/password only if you press a key combination of Ctrl+Enter. On Firefox, the moment that you browse to a site it finds in its password manager, the login fields get automatically filled out. You have to do the final act of logging in by yourself, though. If you have numeral users in your password manager, you will have to fill out the username field yourself, and it will fill in the password automatically for entries it recognizes.

Comment/Reply (w/o sign-up)

I use the opera password manager for some of the sites that i don't care if i lose my password or i need a quick login. The password is encrypted and you can choose if you want to save the password for just that page, the whole server or never. It's a handy feature and in my opinion opera's version is pretty secure. I've never had any passwords leaked or hacked plus you can set a master password each time you want to access the password manager/fill out a login form.

-HellFire

Comment/Reply (w/o sign-up)

So if you have to do the final submission to login, so I don't see why password managers are bad!

Say you got to a page which wants to steal your password as been said, not ../login.html but ../login_x.html, you don't see it, you write the username and password yourself and push the login/submit button, your password is taken by someone, whola!

a password manager, just fills the form with your username and password, you do the same, push the submit/login button and whola, your password is taken.

The only difference is that using a password manager is much faster, you and only you yourself need to know where you login and it is not a password manager fault, it is just a program written for you to make your life easier, more simple.

Comment/Reply (w/o sign-up)

But let's say you visit a site that doesn't have good intentions (aka a phishing site) and they decide to get the passwords from your password manager. If the browser were secure, then these sites should be unable to retrieve your password. However, if the browser were poorly designed, then the site might be able to get a list of your passwords when you submit a form on the site.

That's why password managers are problems--they leave all your passwords out in the open instead of just one if you get tricked to visit and fill out a form at a phishing site. Ex: Let's say there's a phishing site built similar to Gmail. You go there, thinking it is Gmail and fill out your Gmail username and password. If the password manager was secure, you'd only be giving the phishing site your Google username and password. However, if the password manager was insecure, you'd not only be giving away your Google username and password, you'd also give away all other usernames and passwords inside your password manager. Which makes the problem a lot worse.

EDIT: Does anyone here know if the Gmail manager is a secure extension? I've been using that for quite some time and it has proved to be very useful for me. However, I'm not sure if I should continue using it because of its security. It is, after all, run by a third party, and one can never figure out their intentions. I'm inclined to say it has positive intentions, but I'll never know....

Comment/Reply (w/o sign-up)

I never use any kind of password remembering software or write anything down. For every website I go to, I can either reset my password or have them send it to me. I don't want to risk getting my passwords stolen, but I have taken measures to reduce the effects of them getting my password. I use about 6 or so different passwords, so if I loose one, I don't loose security in everything I do online. I live with a couple of roommates, and they swear by the password remembering thing. I can't stand this, because if they don't type it in every time, they will not remember it. They are limited in their passwords because they do not use them everyday. They would be left rather helpless if they had to use somebody else's computer because they wouldn't know their passwords. This is why I use a variety of passwords and do not write them down or have any programs store this information. I don't trust Microsoft (that is what I use mostly)

Comment/Reply (w/o sign-up)

I use several different passwords as well, but I tend to divide my passwords among the sites. For instance, if I find a site to be important, say my Gmail account, then I give it a secure password that I don't reuse. But if I find that I don't care about what I do on a site or that my identity is not at stake, then I just give it one of my regular passwords.

Also, after the recent switch away from password managers, I've discovered that it's a lot easier now to recall passwords when I'm away from my computer. Before whenever I was at school trying to log in to some account, I'd always forget the password and try digging through my email for it. But now, no such thing happens anymore. Ahh, the wonders of breaking away from a bad dependency. XD

Comment/Reply (w/o sign-up)