Comment by vbezhenar | Hacker News Reader

Comment by vbezhenar | Hacker News Reader

Parent Full thread

I've yet to see password manager I'd trust to mess my browser with. I don't want autocomplete. I want convenient and controlled access to my passwords and that's about it. Every password manager wants to run its non-opaque JavaScript on my login pages which I can't allow.

What I need is:

show button on top bar if current website has stored passwords. At this point no logins/passwords are requested from the password manager, only website URLs (or even hashes).

After I click this button, request and show list of logins saved for this website. Let me choose login if there are multiple. Otherwise alter browser context menu.

Now when I right-click on text input, add items like "Insert login: vbezhenar" and "Insert password for vbezhenar".

And only when I choose "insert password" - actually request password from the password manager.

That's the only sane UI. Until I find it or write it myself, I'll continue to copy-paste passwords around.

It's a sad state of things where password managers are still not as usable as text file.

This seems _pretty_ close to how Bitwarden works. In fact, unless I'm missing some requirement, it's close enough that you can do that yourself if you just manually click the "copy username" and "copy password" buttons instead of the usual "just fill crap from this login" button. Those buttons aren't any harder to reach either, they're just smaller.

But are we sure they don't inject any JavaScript before you hit the "fill" button?

Not entirely sure, to be honest. I guess you could just not even install the browser extension and just use the separate application. It'll probably be less secure (don't think it'll know what page you're on, so it can prevent phishing) and more annoying, but if that's a hard requirement it should work.

Maybe I’m missing something, but why would you trust any app to securely store your passwords (or store them at all) but specifically mistrust their browser extension?

1. Browser extension interacts with every website by design. And it means that every website has a direct path to access my passwords if extension is buggy. I don't know how to solve this issue without special browser API, but requiring user to click for every step before sending actual data might reduce that attack surface compared to convenient automatic mode.

2. Web apps are wild and doing wild things. Even humans might find it hard to fill the form correctly. Extension can only observe DOM. Who knows which inputs it will fill with my passwords? I don't trust myself to write that kind of auto fill code which would work reliably. And if I don't trust myself, I definitely don't trust others to do so.

I don't claim that extensions are malicious. That would not make sense indeed. Just that extensions are things I don't trust to be implemented correctly, especially with convenient auto-pilot mode.

Both are great points. Thanks!

Keepass and derivatives like KeepassXC (preferred) have configurable autocomplete which emulates a keyboard and seamlessly moves between UI fields using any key presses you want. By default it switches windows with Alt Tab and Tabs between fields.

this sounds very much like the keepassxc browser integration

That's why there is autofill in Android.

Reply on news.ycombinator.com