• TheBananaKing@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      54
      ·
      9 months ago

      Actually it’s an effective cloud-based password manager that doesn’t rely on local storage or weird plugins or backups.

      That’s what keeps me using chrome. I could lose everything in a house fire, pick up any device, log in and have access to all my stuff without any further action on my part, right out of the box.

      That’s the only feature I care about, and chrome is the only browser I’ve seen that provides it.

      Get me that in firefox, and I’ll switch today.

      • 📛Maven@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        71
        ·
        edit-2
        9 months ago

        What are you talking about? Firefox has had literally Sync since before Chrome existed.

        Firefox Sync initial release: December 21, 2007

        Google Chrome intial release: September 2, 2008 (Beta), (1.0) December 11, 2008

        A full year, my guy.

      • Deebster@programming.dev
        link
        fedilink
        English
        arrow-up
        42
        ·
        edit-2
        9 months ago

        I’m confused since Firefox Sync has been letting you sync/backup your passwords, bookmarks and history for a decade or two at this point, and you can even self-host the sync server.

        I don’t know the complete FF password manager details (Bitwarden user here) but where does Firefox fall short for you?

      • mystik@lemmy.world
        link
        fedilink
        English
        arrow-up
        29
        ·
        9 months ago

        You can lose your Google account in the blink of an eye with no recourse, no access to support or anything.

        With local and my own backups, I can choose to put them at any location, cloud or local.

      • Swaziboy@lemmy.world
        link
        fedilink
        English
        arrow-up
        24
        ·
        9 months ago

        I have all that functionality today with FF… Not sure when you last checked, but if you create a Mozilla account and log in to FF you can sync all the same stuff as Chrome does.

        • TheBananaKing@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          25
          ·
          9 months ago

          Checked it out: apparently I had a mozilla account at one point in time. Hit ‘forgot password’:

          Note: When you reset your password, you reset your account. You may lose some of your personal information (including history, bookmarks, and passwords). That’s because we encrypt your data with your password to protect your privacy.

          Forgot your password: fuck you.

          This is the exact fucking opposite of the behaviour I’d ever want from a password manager.

          • feannag@lemmy.ml
            link
            fedilink
            English
            arrow-up
            29
            ·
            9 months ago

            I think that’s what most people want in a password manager. The only way to have a truly secure pw manager is to encrypt it and failsafe to delete. That way if your identity gets stolen or email compromised, it limits the damage.

            • ilmagico@lemmy.world
              link
              fedilink
              English
              arrow-up
              7
              ·
              9 months ago

              Said another way: if a company offering a password manager can recover all your passwords with you just clicking “forgot password”, that means they can read your passwords in plain text (and so can hackers if the company gets hacked).

          • Passerby6497@lemmy.world
            link
            fedilink
            English
            arrow-up
            5
            ·
            9 months ago

            Forgot your password: fuck you.

            This is the exact fucking opposite of the behaviour I’d ever want from a password manager.

            Wait wait wait wait, you’re telling me you want the people who hold your password to be able to view them without your explicit permission (entering a secret that unlocks your vault)? Because that’s what you’re asking for - if they can reset your password and provide you your plaintext passwords, that means they can 1) read your passwords if they chose to and 2) you can be phished and have your account stolen and passwords provided to some rando.

            The convenience offered by that “feature” is outweighed by the potential consequences of it existing. Passwords should absolutely be a Trust No One (TNO) solution.

            • TheBananaKing@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              2
              ·
              9 months ago

              Pretty much every service on the internet does password-reset via a token sent to your mailbox, so if someone gets control of your mail, you’re pretty much pwned anyway. It would be slower and more inconvenient for an attacker to reset everything individually, but I’m sure they can automate that.

              This is just security theatre. Burning all my data makes my life a lot harder, but an attacker would barely notice.

              If I can reset each individual credential via mail token, on the assumption that only the genuine owner has access to the mailbox, then I lose nothing by resetting access to the whole set of credentials via mail token, on that same assumption.

              • Passerby6497@lemmy.world
                link
                fedilink
                English
                arrow-up
                2
                ·
                edit-2
                9 months ago

                It’s only security theater because you have this kind of mentality:

                It would be slower and more inconvenient for an attacker to reset everything individually, but I’m sure they can automate that.

                then I lose nothing by resetting access to the whole set of credentials via mail token, on that same assumption.

                You’re right that an attacker could reset everything if they had access to your primary email account, but 1) you should already have 2fa on that account to protect yourself, 2) losing access to your email would be a signal that something is wrong and gives you a chance to react before they have everything, and 3) there’s a world of difference between having credentials immediately vs having to jump through hoops to reset stuff. Also:

                Burning all my data makes my life a lot harder, but an attacker would barely notice.

                Burning all your data means your attacker can’t suddenly transfer the contents of your checking account away or buy all kinds of shit from trusted vendors just because they broke into one account. Security is about layered defense, not just giving the attacker keys to the kingdom because you couldn’t remember one password.

      • dasJot@feddit.de
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        1
        ·
        9 months ago

        That’s great until Google finds that one picture of your child at the pool and immediately deletes your CSAM-harboring filthy account.