Why’s there no standard and then MS, Apple etc. can include a pw manager straight into the core OS.
Truth is, most people are shockingly poor when it comes to security. I'd bet that 80% of computer users just store their password in the built-in browser password managers (without even a Master password set) and be done with it. Even worse, I've come across folks storing their passwords on a plain text file.
For the minority who do want secure password management, there are a plethora of solutions, but nothing is completely integrated and seamless. It's all a mish-mash of standalone desktop programs, browser plugins & extensions, web services, cloud storage and so on, all stitched together ad hoc.
This is doable for those who're familiar with security/encryption and can set it all up, maintain and update it, but utterly a non-starter for an average user or smartphone consumer.
The misconception here is that setting a master password provides any real security. It isn't much different if you use a master password or not, once you have autofill, you're already compromised in that threat model.
From the point of view of cracking the password file I'd assume that Mozilla use an encryption key for passing the password file around, just that the key is available to anyone who has access to any of your browsers?
If not then it seems you need physical access, for most people once you access their home then you can access enough info to fraudulently use their identity. So being more secure makes little sense for them, which seems logical. Sure it's increasing the ways an intruder can attack, making a broader attack surface. Once someone had access to your home from a security perspective you'd need to consider all that info compromised, unless you carefully use a home safe, I guess.
I use a plaintext file for some credentials. It seems to me less likely to be recovered than using a widespread service. Would you seek out my house on the promise of pocket change (protected only by my doorlocks and one passphrase) or attack a bank?
On the other hand, passwords stored in the browser are vulnerable to a compromise of the browser as well as a system compromise, so that is one additional weakness. I agree that a local system compromise is almost always game over. The same as physical access.
To answer your question, I'm not sure, but IIRC the Lastpass client was compromised more than once. There were also weaknesses in the way Chrome stored passwords, and of course the Firefox credentials file is easily readable without a Master password set.
Is that true without local access, presumably Moz use a key of some sort to encrypt the passwords before uploading and distributing to your other browsers rather than doing all that in the clear?
- Mainstream GNU/Linux DEs: Gnome Keyring and KDE KWallet (both implement common XDG API)
- Android: Smart Lock Passwords
Neither is interoperable with each other, at least not without external tools (I'm unaware if those exist). I wrote a comment about it the other day: https://news.ycombinator.com/item?id=15697011 (it was about syncing passwords across browsers)
If my interpretation is correct, then I think I need to be the cliche bearer for the XKCD reference: https://xkcd.com/927/
If your interpretation is correct then yeah, Apple has Keychain.
Also, I think I recently got an OS-level 'save password' prompt for something recently on my machine running Win10 Pro v1709... Can anyone confirm or refute this?[1] No clue if this is just a new skin for the existing Credential Manager, something new entirely, or just confusion on my part.
[1] I just now tried Googling for information about this, but I nearly drowned in the sea of links about IE password saving and Edge support for password manager plugins
For local keychains there is /usr/bin/security, but it does not see iCloud keychains.