Password manager of cookies?

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨opt9@feddit.ch⁩ to ⁨privacyguides@lemmy.one⁩

I’m wondering if it isn’t better to just whitelist cookies for the sites I need to log into and not bother with a password manager extension (keepasxc or bitwarden). I try to keep the number of extensions in my browser to a minimum to lower the attack surface. And why involve one more entity in the password story? Are there any problems with using the (1st party) cookies of sites I have signed up to and use to keep me signed in?

source

Comments

Sort:hotnew top

Knuschberkeks@feddit.de ⁨1⁩ ⁨year⁩ ago
well, off i understand you correctly, you want to just stay logged in and never bother with the password in your device? That comes with a heap of problems:

what if someone else gains access to your device, they’d have instant access to all your accounts

what if your device died? If you don’t know the passwords you can never log in on anything else.

if you whitelist cookies those sites could track you across other sites, thus INCREASING your attack surface
source
- opt9@feddit.ch ⁨1⁩ ⁨year⁩ ago
  Thanks for your response. Points 1 and 2 would be the same if I used an in browser password manager. I backup all passwords on my desktop manager and my laptop is pretty hard to break into. For point 3, do 1st party cookies track people? I thought they were mostly benign and for site settings.
  
  source
  - nottelling@lemmy.world ⁨1⁩ ⁨year⁩ ago
    
    No. Your desktop password manager is encrypted with a strong passphrase that locks when you’re computer locks. (Right?) They’d have to snatch your gear mid-session. Cookies are not safe, and cookie hijacks are a pretty common exploit. Cookies are for convenience, not security. Retaining authentication cookies is a very big security hole that we all do, and it’s why banks don’t let you re-auth on a previous session cookie.
    
    “Pretty hard to break into” is the kind of phrase that keeps infosec people up at night.
    
    Yes. First party cookies can be just as nefarious in addition to the technical requirements. 3a. Never assume that something supposed to be “mostly benign” isn’t currently being exploited for bad reasons.
    
    To your OP, It’s actually not a terrible idea to uninstall the PW manager browser extension. It’s one more layer of isolation from the browser. You just lose the convenience of autofill.
    
    source
    -> View More Comments
  - furrowsofar@beehaw.org ⁨1⁩ ⁨year⁩ ago
    No, one and two are not the same. Your PM is not unlocked unless you enter that master password and it will lock after some time period. Many common PMs sync too. Plus you should be using 2FA. If you care about security avoid auto login.
    
    source
    -> View More Comments
Cube6392@beehaw.org ⁨1⁩ ⁨year⁩ ago
I use a desktop password manager and don’t bother with an extension most of the time

source
- opt9@feddit.ch ⁨1⁩ ⁨year⁩ ago
  This is what I was doing before I switched to cookies for convenience. I will be going back to this now.
  
  source
merde@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
in that case i install 2 browsers. One that they use for the sites they need to login (with 3rd party cookies disabled), another with higher security preferences and blockers for general browsing

source