Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Integrate with Web browsers #140

Closed
colans opened this issue Jan 9, 2015 · 23 comments

Comments

Projects
None yet
8 participants
@colans
Copy link

commented Jan 9, 2015

Are there future plans for browser integration, with browser plug-ins similar to the way PasslFox & ChromlPass do it via KeePassHttp (for KeePass)?

@devgeeks

This comment has been minimized.

Copy link
Collaborator

commented Jan 10, 2015

Probably not.

I don't really like auto-fill as it just opens up too many security issues. I would prefer a slightly more cumbersome UX (ie: have to manually go to Encryptr and copy the password you intend to use) than have Encryptr (or a malicious web site) choose for you.

@devgeeks devgeeks closed this Jan 10, 2015

@daviddahl

This comment has been minimized.

Copy link
Contributor

commented Jan 10, 2015

I imagine you could ask for designs and patches to see how that might work - even if you are not interested in doing it yourself? Perhaps a build step could produce a chrome or firefox extension with all of the existing code plus some glue for the pageload/password/form events?

@devgeeks

This comment has been minimized.

Copy link
Collaborator

commented Jan 10, 2015

It was papers like this one: https://www.cs.utexas.edu/~suman/publications/suman_pwdmgr.pdf and others that turned me off auto fill.

Also, auto capture (creating an entry when you sign up for something) causes many issues for new users of SpiderOak, etc with existing managers.

This is more of a conscious design decision than a lack of interest.

@dany-on-demand

This comment has been minimized.

Copy link

commented Jul 27, 2015

Can someone please explain to me, how is encryptr any different from storing a .txt file on say, an encrypted dropbox and keeping notepad.exe open if it's not actually going to do that thing people use password managers for.

@daviddahl

This comment has been minimized.

Copy link
Contributor

commented Jul 27, 2015

I'll just leave this right here: https://en.wikipedia.org/wiki/User_experience

@shibacomputer

This comment has been minimized.

Copy link
Contributor

commented Jul 28, 2015

@dany0, @colans – A good password manager absolutely needs some kind of method for easily extracting passwords from it when authenticated. This feature is a pretty popular request (eg #169), and as part of Encryptr 3.0 we'll be building something along these lines. In this case we need to find the right balance between convenience and security.

@dany-on-demand

This comment has been minimized.

Copy link

commented Jul 28, 2015

Ah, I guess I didn't search issues all that thoroughly. I'll be watching #169 then.

@colans

This comment has been minimized.

Copy link
Author

commented Aug 7, 2015

This issue is older so I'd normally mark the other one as a duplicate, but there's actually work going on in there now. Would probably be best to mark this one as the duplicate then, but I can't find a button for it.

@olluz

This comment has been minimized.

Copy link

commented Aug 11, 2015

Actually, imho Autofill is even more secure than copy/paste-ing password!
Let's just assume I have a password for Paypal stored in my vault.
Now, if I click on a legit Paypal link in an email I will be redirected to the real Paypal site and my vault's autologin will kick in and fill in my username and password.
On the other hand if I am stupid enough to click on a link in a phishing mail that will take me to a fake Paypal site and the autofill will not log me in automatically.
This will alert me that there is something wrong and I will turn on my brain functions.
Whereas when copy paste-ing I will just use the automatism and enter my login details on the fake Paypal site as it looks just like the real thing and might not notice that the URL is wrong

@dany-on-demand

This comment has been minimized.

Copy link

commented Aug 11, 2015

The security problem lies in the fact that detecting login fields in the website DOM is not reliable (and HTML was not designed with this in mind).

I can think of a few solutions that are still convenient but can kind of avoid the problem if you know what you're doing, well no, I dunno really.

@devgeeks another crucial thing to mention is that copy pasting is just another vulnerability and though windows has made significant steps in patching over the holes, snagging data from the clipboard is a favourite of various rootkits and such.

@pedro7

This comment has been minimized.

Copy link

commented Aug 11, 2015

Don't use autofill, don't use copy paste.

In Lastpass, I do ALT+PageDown and only then the login fields are filled.

I may copy/paste and may autofill but I don't rely on them by default.

@dany-on-demand

This comment has been minimized.

Copy link

commented Aug 11, 2015

Yep, basically auto detect with manual "approval". Problem is you have to know what you are doing. A nice solution would protect against stupid.

@shibacomputer

This comment has been minimized.

Copy link
Contributor

commented Aug 11, 2015

@dany0 @pedrogfrancisco how likely is it that someone would have access to your clipboard but not your keystrokes, and therefore remain ignorant to the login details to your password manager?

@dany-on-demand

This comment has been minimized.

Copy link

commented Aug 11, 2015

@helveticade well, I dunno, I just don't want to use the same password on every website, but also want to have at least half the convenience of browser autofill. that's it really.

I used dashlane for a week or so, it was convenient but the software is straight from programmer hell. now I use keepass + chrome plugin and I'm okayish with it. it's not great though.

@pedro7

This comment has been minimized.

Copy link

commented Aug 11, 2015

@helveticade I don't believe manual form fill is made using auto-typing nor copy paste.

@devgeeks

This comment has been minimized.

Copy link
Collaborator

commented Aug 11, 2015

@pedrogfrancisco I suspect LastPass is doing it using JavaScript. The others, no idea.

@olluz the phishing site could have an iFrame to real PayPal and pull your password out when it was filled in.

¯_(ツ)_/¯

Encryptr's philosophy has been about simplicity. I am trying to stick to that while also providing the best UX I can.

@olluz

This comment has been minimized.

Copy link

commented Aug 11, 2015

no, I don't think this will work, as Lastpass logs in based on the site URL. If you are on a different site URL Lastpass will not fill in your credentials.

@devgeeks

This comment has been minimized.

Copy link
Collaborator

commented Aug 11, 2015

LastPass used to be fooled by iframes. It has since been fixed. I am open to finding a way to make password entry easier, but I also want to be careful to do it right.

@devgeeks

This comment has been minimized.

Copy link
Collaborator

commented Aug 11, 2015

Wither way, the real discussion on this should be happening in #139

@shibacomputer

This comment has been minimized.

Copy link
Contributor

commented Aug 11, 2015

This is a tradeoff between security and usability. Obviously, the best security is one that doesn't use the clipboard, and one that doesn't autofill. Until I see otherwise, I'd advocate for using the clipboard over any kind of autofill. Phishing a password through a malicious website seems much easier than dropping an exploit onto a local machine.

@olluz

This comment has been minimized.

Copy link

commented Aug 11, 2015

Again, as I tried to explain earlier. Autofill is much more secure than using copy / paste. If you autofill based upon the site URL there is no way the password is exploit by a malicious website. But for the common user who confuses a malicious website for the real deal will copy paste the password anyway.

@dany-on-demand

This comment has been minimized.

Copy link

commented Aug 11, 2015

In that way, yes, it is more secure. But it can also be fooled to autofill all kinds of things, and an extra "authorisation" step is not foolproof on the side between the chair and the keyboard. Also, #169

@jaredly

This comment has been minimized.

Copy link

commented Oct 20, 2016

:/ unless the website you're on is hacked, or you have a malicious browser extension (in which case you're hosed anyway), there is no way for a 3rd-party website to steal your autofilled passwords.
hoping to clear that up. not in an iframe, not anywhere.
as far as I can tell, autofill is no less secure than typing it in yourself.
hoping to clear that up :D

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.