I use a password manager. I was mobile, the autofill stuff isn't installed as I don't use it often on my phone.

In 15 years of maintaining OSS, I've never been pwned, phished, or anything of the sort.

Thank you for your input :)

yawaramin 3 days ago | parent | next [-]

I'm angry about this. Large megacorps with the budget of medium-sized countries allocate the minimum amount of budget to maintain their auth systems and still allow the use of phishable auth methods. If npm disabled passwords and forced people to use passkeys, this huge problem just disappears tomorrow.

But instead, we're left with this mess where ordinary developers are forced to deal with the consequences of getting phished.

▲

hdjrudni 3 days ago | parent [-]

Passkeys can be a pain in the ass too. Evidentially I set up my Yubikey with Github as some point, which is fine if I'm at my desktop where my key is plugged in, but if I want to sign in on mobile.... now what? I just couldn't log in on mobile for months until I realized I think there's a button on there somewhere that's like "use different 2fa" but then what was even the point of having a key registered if it can be bypassed.

	▲	sneak 3 days ago \| parent \| next [-]
		You can use software u2f (iCloud supports this), you don’t need Yubikeys. Also, Yubikeys work on phones just fine, via both NFC and USB.
	▲	dchest 3 days ago \| parent \| prev \| next [-]
		While you can setup passkeys with YubiKey, the most common intended use case is key pairs that are synchable via your Apple/Google/password manager account. So, once you add a passkey, you'll be able to sign in on mobile with it automatically.
	▲	nialv7 3 days ago \| parent \| prev \| next [-]
		you can use yubikeys for both passkey and password+2fa. this way you aren't bypassing anything. and btw, you can get USB-C yubikeys so you can plug it into your phone. if even that's not an option, you can get a USB-C to USB-A adapter.
	▲	yawaramin 3 days ago \| parent \| prev [-]
		> but if I want to sign in on mobile.... now what? Just set up a new passkey on the mobile device.

▲

sneak 3 days ago | parent | prev | next [-]

I never copy and paste passwords. Any time you find yourself wanting to do that, alarm bells should be ringing.

Password managers can’t help you if you don’t use them properly.

Spotify steals (and presumably uploads) your clipboard, as well as other apps. Autofill is your primary defense against phishing, as you (and hopefully some others) learned this week.

▲

johnisgood 3 days ago | parent | next [-]

Do not give them permission to your clipboard. It is possible today. I copy and paste passwords and I clear the clipboard afterwards, and I do not use junk like Spotify, and were I to use Spotify, it would be through the browser, not the application. Were it the application, it would be firejailed to oblivion.

It is possible to restrict clipboard access when running applications inside Firejail, i.e. Firejail allows you to restrict access to X11 and Wayland sockets, which prevents the sandboxed application from reading or writing to the system clipboard. See: "--x11=none", "--private=...", "--private-tmp", and so forth. You can run a GUI app with isolated clipboard via "firejail --x11=xvfb app".

For Wayland, you should block access to the Wayland socket by adding "--blacklist=/run/user/*/wayland-*".

I do not use autofill on desktop at all. I use it on Android, however.

▲

jasode 3 days ago | parent | prev [-]

>Autofill is your primary defense against phishing,

The autofill feature is not 100% reliable for various reasons:

(1) some companies use different domains that are legitimate but don't exactly match the url in the password manager. Troy Hunt, the security expert who runs https://haveibeenpwned.com/ got tricked because he knew autofill is often blank because of legit different domains[1]. His sophisticated knowledge and heuristics of how autofill is implemented -- actually worked against him.

(2) autofill doesn't work because of technical bugs in the plugin, HTML elements detection, interaction/incompatibility with new browser versions, etc. It's a common complaint with all password plugins:

https://www.google.com/search?q=1password+autofill+doesn%27t...

https://www.1password.community/discussions/1password/1passw...

https://github.com/bitwarden/clients/issues?q=is%3Aissue%20a...

... so in the meantime while the autofill is broken, people have to manually copy-paste the password!

The real-world experience of flaky and glitchy autofill distorts the mental decision tree.

Instead of, "hey, the password manager didn't autofill my username/password?!? What's going on--OH SHIT--I'm being phished!" ... it becomes "it didn't autofill in the password (again) so I assume the Rube-Goldberg contraption of pw manager browser plugin + browser version is broken again."

Consider the irony of how password managers not being perfectly reliable causes sophisticated technical minds to become susceptible to social engineering.

In other words, password managers inadvertently create a "Normalization of Deviance" : https://en.wikipedia.org/wiki/Normalization_of_deviance

[1] >Thirdly, the thing that should have saved my bacon was the credentials not auto-filling from 1Password, so why didn't I stop there? Because that's not unusual. There are so many services where you've registered on one domain (and that address is stored in 1Password), then you legitimately log on to a different domain. -- from: https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mail...

	▲	mdaniel 3 days ago \| parent [-]
		I want to live in a world where the 1Password CEO makes a formal apology for this failure, and applies the necessary internal pressure to treat any "autofill does not work" as a P0 The number of cases in this thread, about a malware attack basically because of 1Password, where people mention their bad experience with 1Password is really stretching the "no such thing as bad publicity" theory

▲

ants_everywhere 4 days ago | parent | prev | next [-]

sounds like you should use it on your phone then

▲

bingabingabinga 4 days ago | parent | prev | next [-]

> In 15 years of maintaining OSS, I've never been pwned, phished, or anything of the sort.

Well, until now.

▲

typpilol 4 days ago | parent | prev [-]

I just don't get how you didn't look for an announcement about npm resetting 2fa. Especially when you get a random reset

	▲	acdha 4 days ago \| parent [-]
		Because you’re one person with a job which isn’t security, and the world is full of legitimate warnings from companies telling you that you must do something by an arbitrary deadline? They screwed up, but we have thousands of years of evidence that people make mistakes even when they really know better and the best way to prevent that is to remove places where a single person making a mistake causes a disaster. On that note, how many of the organizations at risk do you think have contributed a single dollar or developer-hour supporting the projects they trust? Maybe that’s where we should start looking for changes.