Comment on Password manager by Amazon

• Darkassassin07@lemmy.ca ⁨1⁩ ⁨day⁩ ago

  You’ve always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something’s wrong and back away.

  source
• Serinus@lemmy.world ⁨1⁩ ⁨day⁩ ago

  Wait, what? How does autofill get fooled?

  source

  • gaylord_fartmaster@lemmy.world ⁨16⁩ ⁨hours⁩ ago

    Someone manages to maliciously sneak username and password fields onto a site that store what is entered as soon as it’s typed. They don’t even have to be visible to the user and bitwarden will fill them in as soon as the page loads.

    source

    • Serinus@lemmy.world ⁨16⁩ ⁨hours⁩ ago

      Bitwarden will only autofill if the domain matches.

      source

      • gaylord_fartmaster@lemmy.world ⁨14⁩ ⁨hours⁩ ago

        Right, “maliciously sneak”, as in they’ve either gained access to make changes to the site ditectly, or they’ve found a way to inject their scripts to steal creds.

        source

        • -> View More Comments
• lmmarsano@lemmynsfw.com ⁨16⁩ ⁨hours⁩ ago

  they can be fooled too.

  Makes it harder: when I go to the wrong website, the manager simply doesn’t suggest credentials (it does not have) for it. That causes me to wonder why.

  Without a password manager, a user is never prompted to wonder. They’d simply not notice.

  source