Hacker News Reader

Comment by geofft | Hacker News Reader

The most secure is not the most restrictive. A password manager extension has to work. If it doesn't work reliably and people end up copying/pasting passwords, that's not the "most secure".

View on HN

Sure, it should work reliably, but it also shouldn't have unexpected dangerous behavior like OP's complaint that the average user is not aware of.

It could ship with good defaults and at some point, during setup, some introduction or when relevant conditions are met, ask the user if they want to enable that feature/behavior while giving more information about what it does and potential weaknesses. It doesn't have to be disabled forever or hidden behind some obscure feature flag.

> If it doesn't work reliably and people end up copying/pasting passwords, that's not the "most secure".

Why not?

Because one of the security functions of a browser extension (as demonstrated by this very issue) is to ensure that a password for one site only goes to the same site, and not to a convincing-to-a-human phishing site. A browser extension that you can rely on to fill in your password is therefore better for your security than one where you get in the habit of deciding you know better than it and end up copying and pasting passwords and making judgments yourself.

Input just only for specified (registered) domain name is good for security. If you often use copy and paste, you may not notice you're inputting on phishing site that uses different domain name.

Reply on news.ycombinator.com