Hacker News Reader

Comment by y4mi | Hacker News Reader

the nonexistent browser support makes it even more troublesome to setup. there is some support on linux systems, but windows is plain out of luck

i Really like the idea of pass, but ill never accept copy pasting logins/passwords again. they'll need to be automatically inserted on a matching website. everything else is too much manual overhead for my taste.

View on HN

Please understand that browser integration is the Achilles' Heel of password managers. While you get the convenience of autofill, you're also bringing access to your password database into the browser's attack surface. Bugs in the browser sandbox or improper extension implementations can allow rogue sites to get the goods. There have been multiple instances of major password manager extensions leaking secrets just in the last year.

Copying and pasting may be annoying, but it's much safer, especially if you use a program that will autoclear your clipboard for you (KeePass 2 does this after 12 seconds by default).

I agree that browser integration is troublesome. To circumvent having to use a browser extension I use rofi-pass[0] which is a external script (using rofi/dmenu and pass), so no browser integration. But it features autofill which is extremely convenient.

[0] https://github.com/carnager/rofi-pass

Also using rofi-pass, really it's better than browser integration. Especially if you bind it to a hotkey.

In Windows or in general, because pass has a ton of browser extensions.

https://addons.mozilla.org/en-US/firefox/addon/passff/

https://addons.mozilla.org/en-US/firefox/addon/pass-manager/

yes, as i said before. there is some support for linux systems. i'm using both linux and windows as well as android. my password manager will need to support and autofill on all environments with at least firefox and chrome.

pass got linux covered (both chrome and firefox), but doesn't really work for winndows.

android is really tiresome as well, as there is no way to skip my long masterpassword in favour of a fingerprint. I know, its not easy to implement that feature securely.

If you want passwords automatically inserted why not just use the browser's features that do that? I do that for some sites.

it is not as secure

Looks like the iOS app supports browser autofill and there's a Firefox plugin.

Reply on news.ycombinator.com