Comment by loudtieblahblah | Hacker News Reader

Comment by loudtieblahblah | Hacker News Reader

Parent Full thread

loudtieblahblah

I used to use KeePassX (and KeePassXC) for over a decade and I know a lot of people hate it because it doesn't have online syncing and you have to go out of your way to use yet another app to get it to integrate into a browser.

But one of the wonderful things it does over every other password manager is Auto-Fill based on a keybinding.

It would look at the Window Title and find the available passwords that matched. This was infinitely more useful than most browser-plugins that look at URL within the browser.

Because now I could have it fill out auth for Windows shares.

If a website has a .htaccess User/Pass window - most browser plugins wont autofill this, but KeePassX(C) could.

Terminal? I had all my SSH Passphrased and Sudo passwords in KeepassX(C) and could auto-fill on keybinding.

It was wonderful.

After failing to backup my database a few times and losing portions of newly added passwords I finally threw in the towel and went with Bitwarden.

and bitwarden checks a lot of boxes - open source, you can self-host if you wish, third party audits, a good use of encryption, cross-platform both for browsers and desktop/mobile OSes.

but man do i miss just autofilling with a keypress and not reaching for the mouse and autofilling in places outside of the browser.

Anyways, I mention this b/c it's way better than manually copying/pasting. The Auto-fill would work by tossing it to the clipboard just long enough to do the auto-fill and then clearing the clipboard. So it was safer than manual copy/paste too.

> It would look at the Window Title and find the available passwords that matched.

Ew that sounds awful for security and ripe for phishing. Nothing stops a site from setting the title to whatever they want, at least with a browser extension it only shows credentials when the domain matches, giving you a chance to second-guess it.

Seriously, if I own faceboook.com and I just set my title to Facebook, this would copy in my facebook password? Sounds really really bad!

I have used KeepassXC for almost a decade and never used that title matching feature.

Control-U all the way

I think it's great that you use it in a way that protects you by always starting your workflow from your password manager and copying the URL into your browser. But I think it's important to recognize that 1. this requires extra steps, and 2. this represents a drastic change in workflow for the vast majority of users. Your solution will not work for most people.

It doesn't automatically fill it in by landing on the page. It can detect how to autofill, and what password to use, based on window title.

Your scenario still depends on the person landing on a phishing site and choosing to attempt a login.

I think the distinction you're trying to make means zilch, 1. this is the normal login flow for these users, 2. this tech provides zero protection from phishing attacks, 3. an extension does provide protection from phishing attacks by automatically comparing the saved domain vs the page's domain byte-for-byte on every visit and not suggesting a login if the actual domain doesn't match, 4. humans have empirically proven that they cannot do 3 reliably. There is a first hand experience of this fact in this very thread: "The only time I nearly lost an account to phishing it was because I manually copy-pasted my credentials.".

"choosing to attempt to login" is just bare-faced whitewashing in order to blame the user for falling prey to a phishing attack and deny that this is a problem that password managers should solve.

Ah, see that's where I didn't understand you.

I did not make the assumption that my offline password manager should integrate with my web browser to provide phishing protection. That's not a bad idea! I'm not denying it's something password managers could solve. I just don't rely on it.

Interesting, I've been using KeePassX(C) for over a decade too. I store the .kbdx file in a Dropbox folder and can access it from other devices. Never ran into issues with this setup.

At least in the bitwarden chrome extension you can autofill with a keyboard shortcut (and I assume in the ones for other browsers too). On mac os it defaults to CMD+shift+L. But that obviously doesn't work outside of the browser. Still might be interested for you.

I've had an awful time getting this to work consistently. Same with the prompting to add/update a new entry upon creating/changing a password.

Reply on news.ycombinator.com