Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

[Disclosure: I work for AgileBits, makers of 1Password]

One way of characterizing the particular paper is "password managers with browser extensions don't always prevent you from submitting your data to the wrong place."

Systems that rely on the user to copy/paste offer no such protections whatsoever (and so, I suppose, can't fail at them.) So I'm curious about what you may mean by "potentially more secure" in this particular respect. Are you concerned that you might come to rely too heavily on the password manager's anti-phishing mechanisms?

[Note that I fully acknowledge that there may be other security reasons you may wish to keep your password manager out of browser. 1Password and KeePass have different security architectures, development processes, platform support, etc, with their own advantages and disadvantages. People need to figure out which works best for them.]



Not knowing the passwords, and keeping them in a locked database you copy/paste from creates plausible deniability if in a situation where one is beaten with a $5 wrench.

For some people, the risk of disclosure by violence is more a worry than the risk of disclosure by the clipboard.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: