Hacker News Reader

Comment by zeeZ | Hacker News Reader

I disagree. The default for a password manager should be the most secure, with additional features and behavior only being enabled after the user has had at least the chance to make an informed decision.

View on HN

The most secure is not the most restrictive. A password manager extension has to work. If it doesn't work reliably and people end up copying/pasting passwords, that's not the "most secure".

Sure, it should work reliably, but it also shouldn't have unexpected dangerous behavior like OP's complaint that the average user is not aware of.

It could ship with good defaults and at some point, during setup, some introduction or when relevant conditions are met, ask the user if they want to enable that feature/behavior while giving more information about what it does and potential weaknesses. It doesn't have to be disabled forever or hidden behind some obscure feature flag.

> If it doesn't work reliably and people end up copying/pasting passwords, that's not the "most secure".

Why not?

Because one of the security functions of a browser extension (as demonstrated by this very issue) is to ensure that a password for one site only goes to the same site, and not to a convincing-to-a-human phishing site. A browser extension that you can rely on to fill in your password is therefore better for your security than one where you get in the habit of deciding you know better than it and end up copying and pasting passwords and making judgments yourself.

Input just only for specified (registered) domain name is good for security. If you often use copy and paste, you may not notice you're inputting on phishing site that uses different domain name.

Reply on news.ycombinator.com