Are password manager browser extensions safe ?

[jetman]

It seems to me that password managers are a sensible idea for most people these days.

I use Sticky Password, but I think most password managers work in a similar manner. Using Windows, Sticky has a desktop application and a browser extension. Once the master password is entered on the desktop application the password database is unlocked. Passwords can then be accessed from the desktop application or from the browser extension. I can therefore copy and paste passwords into web pages manually from the desktop application, OR if use the browser extension it will auto-fill the relevant parts of the website for me.

I would imagine that password managers are most vulnerable to attack when the database is unlocked. What is to stop a corrupted website or piece of malware from tricking a browser extension into revealing all of a user's passwords ? I know that the desktop application could also be hacked, but it seems to me that a browser extension may be more vulnerable. I am therefore wondering if I should uninstall the browser extension and just manually copy and paste from the desktop application. Would this reduce my attack profile ?

I've referred to Sticky Password above, but its a general question for all password managers.

 

[Threadripper]

There's nothing stopping them, which is why password managers like Bitwarden don't auto-fill by default and you have to select a single relevant login. If a website had a hidden frame with a google.com login, they're getting your Google password if you have auto-fill on.

 

[Paul.R]

I use Bitwarden for almost 3 years, never had a problem

 

[Divine_Barakah]

Here's a useful link from Remembear blog

Securing the RememBear Browser Extensions

Editor’s note: This blog post requires some base level understanding of cryptography and networking protocols. We’d like to share the details behind the decisions that secure the contents of your RememBear, but some of them are fairly technical. Links to outside resources have been provided...

www.remembear.com