Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions?

Quite bizarre to think much much of my well-being depends on those secrets staying secret.

▲ zerkten 4 hours ago | parent | next [-]

Integration points increase the risk of compromise. For that reason, I never use the desktop browser extensions for my password manager. When password managers were starting to become popular there was one that had security issues with the browser integration so I decided to just avoid those entirely. On iOS, I'm more comfortable with the integration so I use it, but I'm wary of it.

▲

brightball 4 hours ago | parent | next [-]

The problem is that the UX with a browser extension is so much better.

▲

tracker1 4 hours ago | parent | next [-]

I also find it far easier to resist accidentally entering credentials in a phishing site... I'm pretty good about checking, but it's something I tend to point out to family and friends to triple check if it doesn't auto suggest the right site.

	▲	brightball 4 hours ago \| parent \| next [-]
		Exactly. Same principle of passkeys, Yubikeys and FIDO2. Much harder to phish because the domains have to match.
	▲	Barbing 3 hours ago \| parent \| prev [-]
		I’m impressed with their feature to add the URL for next time, after manually filling on an unmatched URI. Hairs raised on neck clicking confirm though.

▲

tredre3 43 minutes ago | parent | prev | next [-]

> The problem is that the UX with a browser extension is so much better.

It's better, but calling it so much better [that it's unreasonable to forgo the browser extension] is a bit silly to me.

1. Go to website login page

2. trigger the global shortcut that will invoke your password manager

3. Your password manager will appear with the correct entry usually preselected, if not type 3 letters of the site's name.

4. Press enter to perform the auto type sequence.

There, an entire class of exploits entirely avoided. No more injecting third party JS in all pages. No more keeping an listening socket in your password manager, ready to give away all your secrets.

The tradeoff? You now have to manually press ctrl+shift+space or whatever instead when you need to log in.

	▲	dwedge 3 minutes ago \| parent \| next [-]
		How do you set up this shortcut? I'd prefer to get rid of extensions, if for no better reason than sometimes it switches to my work profile and I have to re-login
	▲	Ritewut 22 minutes ago \| parent \| prev [-]
		The tradeoff is that you need to know how to setup a global shortcut or even know it's even possible. I wish people would stop minimizing the knowledge they have as something everyone just knows.

▲

ufmace 3 hours ago | parent | prev | next [-]

Importantly IMO is the extra phishing protection that the UX is really nice if and only if the url matches what's expected. If you end up on a fake url somehow, it's a nice speed bump that it doesn't let you auto-fill to make you think, hold on, something is wrong here.

If you're used to the clunkier workflow of copy-pasting from a separate app, then it's much easier to absent-mindedly repeat it for a not-quite-right url.

▲

QuantumNomad_ 4 hours ago | parent | prev | next [-]

The 1Password mobile and desktop apps have such a nice UX that I’m happy copy pasting from and into it instead of having any of the browser extensions enabled.

I have 1Password configured to require password to unlock once per 24 hours. Rest of the time I have it running in the background or unlock it with TouchID (on the MacBook Pro) or FaceID (on the iPhone).

It also helps that I don’t really sign into a ton of services all the time. Mostly I log into HN, and GitHub, and a couple of others. A lot of my usage of 1Password is also centered around other kinds of passwords, like passwords that I use to protect some SSH keys, and passwords for the disk encryption of external hard drives, etc.

▲

embedding-shape 4 hours ago | parent [-]

> The 1Password mobile and desktop apps have such a nice UX that I’m happy copy pasting from and into it instead of having any of the browser extensions enabled.

Also a great way of missing out on one of the best protections of password managers; completely eliminating phishing even without requiring thinking. And yes, still requires you to avoid manually copy-pasting without thinking when it doesn't work, but so much better than the current approach you're taking, which basically offers 0 protection against phishing.

▲

yborg 3 hours ago | parent | next [-]

My approach is that for critical sites like banking, I use the site URL stored in the password manager too, I don't navigate via any link clicking. I personally am fine with thinking when my entire net worth is potentially at stake.

▲

embedding-shape 3 hours ago | parent [-]

It's not only about how you get there, but that the autofill shows/doesn't show, which is the true indicator (beyond the URL) if you're in the right place or not.

Rouge browser extensions for example could redirect you away from the bank website (if the bank website has poor security) when you go there, so even if you use the URL from the password manager, if you don't use the autofill feature, you can still get phished. And if the autofill doesn't show, and you mindlessly copy-paste, you'd still get phished. It's really the autofill that protects you here, not the URL in the password manager.

▲

QuantumNomad_ 3 hours ago | parent [-]

If you have rogue browser extensions installed, the browser extension can surely read the values that got filled into the login page without having to redirect to another site.

	▲	embedding-shape 3 hours ago \| parent [-]
		Not necessarily, a user could have accepted a permission request for some (legit) redirect extension that never asked for content permission, then when the rogue actor takes over, they want to compromise users and not change the already accepted permissions. Concretely, I think for redirect browser extension users I'd use "webRequest" permission, while for in page access you'd need a content-script for specific pages, so in practice they differ in what the extension gets access to.

▲

QuantumNomad_ 3 hours ago | parent | prev [-]

In Safari on iOS I have all the main pages I use as favourites, so that they show on the home screen of Safari.

Likewise I have links in the bookmarks bar on desktop.

I use these links to navigate to the main sites I use. And log in from there.

I don’t really need to think that way either.

But I agree that eliminating the possibility all-together is a nice benefit of using the browser integration, that I am missing out on by not using it.

	▲	embedding-shape 3 hours ago \| parent [-]
		Which works great until tags.tiqcdn.com, insuit.net or widget-mediator.zopim.com (example 3rd party domains loaded when you enter the landing page from some local banks) get compromised. I guess it's less likely to happen with the bigger banks, my main bank doesn't seem to load any scripts from 3rd party as an counter-example. Still, rouge browser extensions still scare me, although I only have like three installed.

▲

lern_too_spel 3 hours ago | parent | prev [-]

Also, you want to avoid exposing your passwords through the clipboard as much as possible.

▲

WhyNotHugo 2 hours ago | parent | prev [-]

In theory the browser integration shouldn’t leak anything beyond the credentials being used, even if compromised.

When you use autofill, the native application will prompt to disclose credentials to the extension. At that point, only those credentials go over the wire. Others remain inaccessible to the extension.

▲ uyzstvqs 3 hours ago | parent | prev | next [-]

We need cooldowns everywhere, by default. Development package managers, OS package managers, browser extensions. Even auto-updates in standalone apps should implement it. Give companies like Socket time to detect malicious updates. They're good at it, but it's pointless if everyone keeps downloading packages just minutes after they're published.

▲ srigi 3 hours ago | parent | next [-]

That is why we have discussions like these: https://x.com/i/status/2039099810943304073

	▲	tadfisher 2 hours ago \| parent [-]
		X is the worst place to hold community discussions.

▲ eranation 3 hours ago | parent | prev | next [-]

Exactly this. For anyone who wants to do it for various package managers:

  ~/.npmrc: 
  min-release-age=7 (npm 11.10+)

  ~/Library/Preferences/pnpm/rc: 
  minimum-release-age=10080 (minutes)

  ~/.bunfig.toml 
  [install]: 
  minimumReleaseAge = 604800 (seconds)

This would have protected the 334 people who downloaded @bitwarden/cli 2026.4.0 ~19h ago (according to https://www.npmjs.com/package/@bitwarden/cli?activeTab=versi...). Same for axios last month (removed in ~3h). Doesn't help with event-stream-style long-dormant attacks but those are rarer.

(plug: released a small CLI to auto-configure these — https://depsguard.com — I tried to find something that will help non developers quickly apply recommended settings, and couldn't find one)

▲

m4r71n 3 hours ago | parent [-]

https://cooldowns.dev/#javascript-ecosystem ;-)

	▲	eranation 2 hours ago \| parent [-]
		Love it, I'll link to it!

▲ tomjen3 2 hours ago | parent | prev [-]

I am not sure that works - imagine that the next shellshock had been found. Would you want to wait 7 days to update?

We need to either screen everybody or cut of countries like North Korea and Iran from the Internet.

	▲	tadfisher 2 hours ago \| parent [-]
		These vulnerabilities are all caught by scanners and the packages are taken down 2-3 hours after going live. Nothing needs to take 7 days, that's just a recommendation. But maybe all packages should be scanned, which apparently only takes a couple of hours, before going live to users?

▲ sph 3 hours ago | parent | prev | next [-]

> What can I do to prevent it?

My two most precious digital possessions - my email and my Bitwarden account - are protected by a Yubikey that's always on my person (and another in another geographical location). I highly recommend such a setup, and it's not that much effort (I just keep my Yubikey with my house keys)

I got a bit scared reading the title, but I'm doing all I can to be reasonably secure without devolving into paranoia.

▲

ThePowerOfFuet 3 hours ago | parent [-]

If the software gets poisoned then your YubiKey will not save you.

	▲	hgoel 3 hours ago \| parent [-]
		I think they mean to secure your most valuable accounts with a hardware token rather than in a normal password manager, so they aren't at risk if your password manager has an issue.

▲ streb-lo 4 hours ago | parent | prev | next [-]

Use the desktop or web vault directly, don't use the browser plugin.

▲ eranation 2 hours ago | parent | prev | next [-]

How to prevent it?

tl;dr

- https://cooldowns.dev

- https://depsguard.com

(disclaimer: I maintain the 2nd one, if I knew of the first, I wouldn't have released it, just didn't find something at that time, they do pretty much the same thing, mine in a bit of an overkill by using rust...)

▲ ffsm8 4 hours ago | parent | prev [-]

You should use hunter2 as your password on all services.

That password cannot be cracked because it will always display as ** for anyone else.

My password is *****. See? It shows as asterisks so it's totally safe to share. Try it!

... Scnr •́ ‿ , •̀

	▲	wing-_-nuts 3 hours ago \| parent [-]
		ah, the old bash.org.