No-one should be using any password manager built into any browser, neither Chromium-based nor Firefox-based. Browser password databases are almost trivially easy for malware to harvest.
Go with something external, BitWarden or 1Password, or if you are entirely within the Apple ecosystem their new password system built into iOS 18 is apparently really good.
Go with something external, BitWarden or 1Password,
When it comes to security software, I usually recommend sticking to open-source solutions, which is why I’d recommend Bitwarden over 1Password. Their whole stack (backend, frontend, and native apps) is all open-source. A premium account is well worth the $10/year.
You can self-host their server, or self-host Vaultwarden which is an unofficial API-compatible reimplementation of the Bitwarden backend designed to be lighter weight. Note that Vaultwarden is unofficial and hasn’t gone through the same security audits as Bitwarden has. It’s a good piece of software though.
Use ButWarden myself for a login-only subset of my KeePass content. I absolutely recommend it every chance I get, but some people prefer 1Password because reasons. And 1Password is pretty much the best closed-source option out there, which is why I do so… anything to give people options that keep them away from clusterf**ks like LastPass.
I migrated from Bitwarden to 1password because I wanted something that works better on Linux. With 1password-cli and PAM integration mainly. Bitwarden worked beautifully under Windows, but once I switched over to Linux, I realised that 1password had more Linux friendly features. I track some discussions over bitwarden that talk about implementing those features, I might come back at some point.
Definitely true… Using 1Password is still better than reusing the same password for every site. I’ve never used it but it gets a lot of good feedback, especially from Mac users.
The only problems I’ve had with 1password are usually not 1password’s fault. Like needing to log into something that opened through the Gmail’s app’s built in browser that closed the page when the app loses focus.
I wish there was a way to link passwords and have note fields that are hidden by default. I’ve got a lot of stuff at work that is linked to my LDAP password but for various reasons uses different usernames on different sites. It’d be nice if there was a way to tell it “I know this password is reused, I promise it’s okay”
That’s what I used before 1password. The UI is a bit finicky but it works great. Plus you can shove it into DropBox or other various cloud sync things to get a “cloud” version lol.
I have that as an offline DB. Holds 100% of all creds that can go offline (no 2FA, unfortunately) and a bunch of extra stuff that most other managers aren’t flexible enough to do.
What makes the built-in database easier to attack than a separate one?
For performance reasons, early versions weren’t even encrypted, and later versions were encrypted with easily-cracked encryption. Most malware broke the encryption on the password DB using the user’s own hardware resources before it was even uploaded to the mothership. And not everyone has skookum GPUs, so that bit was particularly damning.
Plus, the built-in password managers operated within the context of the browser to do things like auto-fill, which meant only the browser needed to be compromised in order to expose the password DB.
Modern password managers like BitWarden can be configured with truly crazy levels of encryption, such that it would be very difficult for even nation-states to break into a backed-up or offline vault.
How does this work if accessing Bitwarden via the browser extension? I don’t like needing to type my master password in all the time as it’s long, so I have the setting turned on that times the vault out periodically, but so it’s also unlockable with a pin rather than requiring the master password every time. I understand the pin is shorter, but does the protection of the vault still stand?
That’s a good question. I don’t actually know the answer to that. I know the passwords are hashed locally when your vault is locked and before being synced, but I’m not sure whether it’s in plaintext when it’s unlocked or if it uses some kind of on-demand decryption. It’s probably in their docs, I should think.
No-one should be using any password manager built into any browser, neither Chromium-based nor Firefox-based. Browser password databases are almost trivially easy for malware to harvest.
Go with something external, BitWarden or 1Password, or if you are entirely within the Apple ecosystem their new password system built into iOS 18 is apparently really good.
When it comes to security software, I usually recommend sticking to open-source solutions, which is why I’d recommend Bitwarden over 1Password. Their whole stack (backend, frontend, and native apps) is all open-source. A premium account is well worth the $10/year.
You can self-host their server, or self-host Vaultwarden which is an unofficial API-compatible reimplementation of the Bitwarden backend designed to be lighter weight. Note that Vaultwarden is unofficial and hasn’t gone through the same security audits as Bitwarden has. It’s a good piece of software though.
Use ButWarden myself for a login-only subset of my KeePass content. I absolutely recommend it every chance I get, but some people prefer 1Password because reasons. And 1Password is pretty much the best closed-source option out there, which is why I do so… anything to give people options that keep them away from clusterf**ks like LastPass.
I migrated from Bitwarden to 1password because I wanted something that works better on Linux. With 1password-cli and PAM integration mainly. Bitwarden worked beautifully under Windows, but once I switched over to Linux, I realised that 1password had more Linux friendly features. I track some discussions over bitwarden that talk about implementing those features, I might come back at some point.
Definitely true… Using 1Password is still better than reusing the same password for every site. I’ve never used it but it gets a lot of good feedback, especially from Mac users.
The only problems I’ve had with 1password are usually not 1password’s fault. Like needing to log into something that opened through the Gmail’s app’s built in browser that closed the page when the app loses focus.
I wish there was a way to link passwords and have note fields that are hidden by default. I’ve got a lot of stuff at work that is linked to my LDAP password but for various reasons uses different usernames on different sites. It’d be nice if there was a way to tell it “I know this password is reused, I promise it’s okay”
I use Keepass. Free, secure, great.
That’s what I used before 1password. The UI is a bit finicky but it works great. Plus you can shove it into DropBox or other various cloud sync things to get a “cloud” version lol.
I have that as an offline DB. Holds 100% of all creds that can go offline (no 2FA, unfortunately) and a bunch of extra stuff that most other managers aren’t flexible enough to do.
What makes the built-in database easier to attack than a separate one?
For performance reasons, early versions weren’t even encrypted, and later versions were encrypted with easily-cracked encryption. Most malware broke the encryption on the password DB using the user’s own hardware resources before it was even uploaded to the mothership. And not everyone has skookum GPUs, so that bit was particularly damning.
Plus, the built-in password managers operated within the context of the browser to do things like auto-fill, which meant only the browser needed to be compromised in order to expose the password DB.
Modern password managers like BitWarden can be configured with truly crazy levels of encryption, such that it would be very difficult for even nation-states to break into a backed-up or offline vault.
It’s protected by the user’s login password. If an attacker can steal that or knows it already, the passwords are all there for them to see.
Bitwarden (on the other hand, for example) has 2FA options to unlock the database.
How does this work if accessing Bitwarden via the browser extension? I don’t like needing to type my master password in all the time as it’s long, so I have the setting turned on that times the vault out periodically, but so it’s also unlockable with a pin rather than requiring the master password every time. I understand the pin is shorter, but does the protection of the vault still stand?
That’s a good question. I don’t actually know the answer to that. I know the passwords are hashed locally when your vault is locked and before being synced, but I’m not sure whether it’s in plaintext when it’s unlocked or if it uses some kind of on-demand decryption. It’s probably in their docs, I should think.
Oh, so you mean local vs external, not browser-based vs other local solutions.