@iluom
...Does a browser plug-in for password manager really safe to use?...
Current thinking (see 800-63B §5.1.1.2) is that long, unique passwords per site are best and that password managers are a good way to encourage this behavior. How to implement this is fundamentally a risk vs convenience tradeoff.
@AppDefects apparently feels that the entire browser environment is not a safe location for passwords, presumably, copy/pasting passwords as necessary. If one can tolerate the inconvenience, this is excellent advise. I, on the other hand need a bit more convenience to keep me from short-circuiting the process (e.g. using short passwords for sites I also need on my phone).
To decide if a plugin was safe, I evaluated:
- How widely it was used (e.g. Lastpass claim 13.5 Million installs, 1Password claims "millions"). The thought being that the more popular something is, the more scrutiny it gets from the press and from the experts.
- Impact to the supplier if the product were breached. I would prefer to stick with somebody who has lots to lose if they get it wrong (e.g. company goes out of business; employees lose job) vs a product simply being abandoned or discontinued.
- Its reputation in the popular and trade press, app-store ratings, etc.
- How long it has been around and how completely it solves the problem.
- How the manufacturer makes money. If they charge a reasonable subscription, they are less likely to need to do unsightly things to make payroll.
In the end, I found a few plugins I felt were "safe enough" for me.
@MikeGlassman raises an interesting related topic, are the built in managers good enough? A few things I found tipped the scales for me:
- Included password generator makes "99 random character" passwords easy.
- Ability to "link" entries together, so that the same password automatically fills on login.live.com and login.office365.com,
- Works with web pages that oddly name the password field.
- Sync between my computers and between my browsers, so I don't need to update passwords in multiple places.
- Auto-fill into apps (gmail, banking, etc) on my phone, so I don't have to deal with strong passwords on crappy keyboards.
- Audit function identifies accounts that use the same password a long-lived password, or a weak password.
- Password history, so I can recover if something goes wrong with a password change.
- Comments field allows me to store answers to "3 security questions", which I also auto-generate instead of using factual data.
- Comments also allow storage of product keys, account numbers, etc.
- Can export the entire database to a clear-text CSV text file, which I occasionally put on a flash drive in my safe to protect against database corruption or vendor suicide.
