I am curious to know of what is safer to use with the browser inclused with Fedora (firefox). Is it a risk to use the password manager built into the browser. I have read this is not safe for banking and other important credentials.
What steps could be taken to mitigate this risk, such as a Bitwarden plugin, is this better or not neccasary?
I donât think there will be a simple yes or no answer to this question.
Security is a balance of cost / risk .
I find Password Managers are not saving Financial Website passwords by default (Bitwarden, LastPass, Chrome, Firefox) . I donât know how they classify which website is a Financial one.
Also store the username in the password file? pass has no restrictions on what you can save in the file. For example, my pass files are:
<password>
Username: <username>
E-mail: <e-mail>
<Any other additional info>
I save these files as: <hostname> or if I have multiple accounts for the same hostname, <username@hostname>.
I use qutebrowser which as a userscript to use pass, which reads the password from the first line and username from a line with username:, and this can be changed depending on how you format your pass files.
+1 for KeePassXC, look at how easy (in most cases) browsers import each otherâs password databases.
It seems reasonable to create a separate database with only a subset of passwords that might be of use on mobile - security there is by far inferior.
A compromise between security and convenience might be using a second factor to secure the database, e.g. a generated key file, and synchronising only the database through some cloud. That way DB is harder to crack while having a backup and synchronisation. Itâs also a better way for syncing passwords with a mobile.
your both arguments (â+1 for KeePassXCâ and ââŠsecurity there is by far inferiorâ are somewhat contrary.
cause the DBâs of KeepassXYZ are secure and namely everywhere or they are not (independantly how much passwords they contain)
I meant that security on mobile devices is worse than on linux PC/laptop. At rest passwords are secure, but anything can happen when you open it on a device with known vulnerabilities.
If having a command line interface like pass appeals to you but you also like KeePassXC, note that KeePassXC includes keepass-cli (which also has an interactive mode). If youâre on macOS and using KeePassXC.app rather than installing via homebrew, or similar, you can find it at /Applications/KeePassXC.app//Contents/MacOS/keepassxc-cli .
FWIW, and going back to OPâs question, I think some prefer a password manager like Bitwardenâas I doâbecause there have been third-party audits of it and it is open source; AFAIK, the built-in Firefox manager has neither been audited nor is it open source.
All the previous posters make very good points about where the password db is housed and comment clearly on the benefits of not having it in the cloud; however, for my purposes, I prefer saving hashed and salted in the cloud with a developer I trust.
So would you trust Bitwarden I have trusted them as they are open source. I guess I trust that other users audit there code from time to time say every quarter or semi annually.
So trusting the firefox password manager is not advised would you say? Iâm a bit worried about all the trust I put in my browser, I have a lot of passwords and if there is a breach I could be compromised⊠The convenience of the browser remembering all my logins is so very helpful as I run CalyxOS on my smartphone and each time I login I need to unlock bitwarden and paste in the password and it happens many times a day and slows me down a lot as I login and out of many user interfaces.
No password-only authentication is safe, independent of what password manager you use. What you need is Two Factor Authentication, including for your online banking site.
Great, thanks Iâll contact the banks and get that setup, thanks a lot. So for other non-2 factor authentication for important access, would you not save passwords to the browser ?
Where possible, use some second factor of authentication: one time password (e.g. andOTP) or some hardware key (Solo key, Nitrokey, Yubikey).
There are add-ons that integrate KeePassXC with browsers, making it almost as easy to use as built-in password managers: KeePassXC: Getting Started Guide
If you want to use browserâs password manager, at least enable master password (Firefox), which has to be entered to unlock saved passwords.
