Reply to thread

Message

<blockquote data-quote="jetman" data-source="post: 826694" data-attributes="member: 63028">It seems to me that password managers are a sensible idea for most people these days.I use Sticky Password, but I think most password managers work in a similar manner. Using Windows,&nbsp; Sticky has a desktop application and a browser extension.&nbsp; Once the master password is entered on the desktop application the password database is unlocked.&nbsp; Passwords can then be accessed from the desktop application or from the browser extension.&nbsp; I can therefore copy and paste passwords into web pages manually from the desktop application,&nbsp; OR if use the browser extension it will auto-fill the relevant parts of the website for me.I would imagine that password managers are most vulnerable to attack when the database is unlocked.&nbsp; What is to stop a corrupted website or piece of malware from tricking a browser extension into revealing all of a user&#039;s passwords ?&nbsp; I know that the desktop application could also be hacked, but it seems to me that a browser extension may be more vulnerable.&nbsp; I am therefore wondering if I should uninstall the browser extension and just manually copy and paste from the desktop application.&nbsp; Would this reduce my attack profile ?I&#039;ve referred to Sticky Password above, but its a general question for all password managers.</blockquote>

[QUOTE="jetman, post: 826694, member: 63028"] It seems to me that password managers are a sensible idea for most people these days. I use Sticky Password, but I think most password managers work in a similar manner. Using Windows, Sticky has a desktop application and a browser extension. Once the master password is entered on the desktop application the password database is unlocked. Passwords can then be accessed from the desktop application or from the browser extension. I can therefore copy and paste passwords into web pages manually from the desktop application, OR if use the browser extension it will auto-fill the relevant parts of the website for me. I would imagine that password managers are most vulnerable to attack when the database is unlocked. What is to stop a corrupted website or piece of malware from tricking a browser extension into revealing all of a user's passwords ? I know that the desktop application could also be hacked, but it seems to me that a browser extension may be more vulnerable. I am therefore wondering if I should uninstall the browser extension and just manually copy and paste from the desktop application. Would this reduce my attack profile ? I've referred to Sticky Password above, but its a general question for all password managers. [/QUOTE]

Verification