No, one and two are not the same. Your PM is not unlocked unless you enter that master password and it will lock after some time period. Many common PMs sync too. Plus you should be using 2FA. If you care about security avoid auto login.
Comment on Password manager of cookies?
opt9@feddit.ch 11 months agoThanks for your response. Points 1 and 2 would be the same if I used an in browser password manager. I backup all passwords on my desktop manager and my laptop is pretty hard to break into. For point 3, do 1st party cookies track people? I thought they were mostly benign and for site settings.
furrowsofar@beehaw.org 11 months ago
opt9@feddit.ch 11 months ago
Yeah, I was thinking of browser PM with auto signin. But I’m dropping all that now. I wonder why these privacy and security focused browsers like Brave include options like this if they are bad for users.
nottelling@lemmy.world 11 months ago
No. Your desktop password manager is encrypted with a strong passphrase that locks when you’re computer locks. (Right?) They’d have to snatch your gear mid-session. Cookies are not safe, and cookie hijacks are a pretty common exploit. Cookies are for convenience, not security. Retaining authentication cookies is a very big security hole that we all do, and it’s why banks don’t let you re-auth on a previous session cookie.
“Pretty hard to break into” is the kind of phrase that keeps infosec people up at night.
Yes. First party cookies can be just as nefarious in addition to the technical requirements. 3a. Never assume that something supposed to be “mostly benign” isn’t currently being exploited for bad reasons.
To your OP, It’s actually not a terrible idea to uninstall the PW manager browser extension. It’s one more layer of isolation from the browser. You just lose the convenience of autofill.
opt9@feddit.ch 11 months ago
Thanks, I will be deleting all cookies and using my desktop keepassxc.