114
Password manager by Amazon
(lemmy.world)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 19 Jul 2025
114 points (91.3% liked)
Technology
73570 readers
1416 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
Here's the thing .. as crazy as a notebook with passwords sounds, it's not accessible to someone across the internet.
Password managers check the URL before giving its data. A human being can be fooled into giving it to a fake web site.
TBF, they can be fooled too.
Bitwarden warns against using autofill on load for that very reason, as then simply loading a malicious page might cause it to provide passwords to such a site.
And then, a human when a site doesn't autofill, is more likely to just go "huh, weird" and do it manually.
You've always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something's wrong and back away.
If you're already used to manually typing in the auth details, you may not even notice you're not on the site you were expecting.
Makes it harder: when I go to the wrong website, the manager simply doesn't suggest credentials (it does not have) for it. That causes me to wonder why.
Without a password manager, a user is never prompted to wonder. They'd simply not notice.
Wait, what? How does autofill get fooled?
Someone manages to maliciously sneak username and password fields onto a site that store what is entered as soon as it's typed. They don't even have to be visible to the user and bitwarden will fill them in as soon as the page loads.
Bitwarden will only autofill if the domain matches.
Right, "maliciously sneak", as in they've either gained access to make changes to the site ditectly, or they've found a way to inject their scripts to steal creds.
And how is that any different from not having a password manager?
Yes, if someone hijacks a domain they can get credentials intended for that domain. A password manager doesn't make a huge difference here, because why would they make the site look any different than normal?
I guess you didn't read most of the comment.
No, he did, here's where the confusion is.
Serinus is asking if the site in question needs to be compromised. In other words, can the attacker compromise a random site to fool your password manager into entering credentials for Gmail.com, or does the attacker have to compromise Gmail.com to do that?
Because those two attacks are very different levels of complexity.
And frankly, if someone compromises the site you're actually trying to visit, there's simply no defense against that at all.
It depends on what the user fills it with.
Even the objectively safest solutions will be much shorter, and have less entropy, than what a pw-manager can deal with.
Just maybe don't plaster "THESE ARE MY SECRETS" on the cover. Security through obscurity.
My mom had a nice little notebook for passwords. But when she passed, we couldn't find it anywhere... We went through the whole apartment, everything.
Not having her passwords made a lot of things harder, closing her accounts, accessing her laptop, phone, etc. So while you shouldn't advertise it, do tell a few people where to find it if they need to.
Yeah, It's actually quite a secure way to store passwords, since it requires physical access.
I knew a guy who had a drawer full of slips of paper with passwords written on. He called it the "security drawer". Made me smile, but probably shouldn't have been advertising it.
Oh I know him. What a weirdo. Fun guy tho. Did he move what’s his new address anyway?