| ▲ | weird-eye-issue 6 hours ago |
| This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match |
|
| ▲ | tuetuopay an hour ago | parent | next [-] |
| That's without considering a lot of banks have non-textual inputs for their passwords. Man they love their scrambled virtual keyboard! I think the worst I ever had was HSBC that asked me for fragments of my password, like characters 4, 6, 7, 11, and 12. Absolute bonkers of a security theatre. |
|
| ▲ | StableAlkyne 5 hours ago | parent | prev | next [-] |
| I use keepass (FOSS under GPL, fully offline). It does not detect domains. |
| |
| ▲ | jabroni_salad 4 hours ago | parent | next [-] | | The autotyper can with a little bit of finangling. Every browser has a 'url in title bar' extension avaialble and then you can use that for your autotype matching. If you do not like to use extensions, changing a page's title is a trivial bookmarklet or userscript to make I would think. | |
| ▲ | graemep 5 hours ago | parent | prev | next [-] | | KeepassXC browser integration will do that. | |
| ▲ | throawayonthe 3 hours ago | parent | prev [-] | | you can have it be offline and still a browser extension (when i used keepassxc it could to that) |
|
|
| ▲ | vel0city 6 hours ago | parent | prev [-] |
| "Dang, this site isn't working right with the password manager's detection. Guess I just gotta paste the password in again..." Meanwhile U2F/Passkeys can't possibly be abused like this. |
| |
| ▲ | tjoff 6 hours ago | parent | next [-] | | Yeah but the downsides of passkeys make them so much worse anyway. | | |
| ▲ | jcattle 5 hours ago | parent [-] | | Pretty happy with having a yubikey on my keychain. Log in someplace new? plonk in your yubikey and off you go! | | |
| ▲ | AlotOfReading 5 hours ago | parent | next [-] | | I used to keep a yubikey in a spare slot on my laptop. One day it fell out and subsequently escaped through an unnoticed hole in my backpack. I've never lost a password because my backpack was overly abused. | | |
| ▲ | brendoelfrendo 5 hours ago | parent [-] | | That's why you keep it on your keychain and not in a spare slot on your laptop. | | |
| ▲ | AlotOfReading 3 hours ago | parent [-] | | It's not possible to put a 5c nano on a keychain. They're intended to be kept in the slot at all times. | | |
|
| |
| ▲ | someguyiguess 5 hours ago | parent | prev [-] | | And when your keychain gets lost then what? | | |
| ▲ | jcattle 5 hours ago | parent | next [-] | | Then I have a backup yubikey at home for services which allow to register two keys. For other's there's still good old password+some second factor. | |
| ▲ | vel0city 3 hours ago | parent | prev | next [-] | | Then I use the authenticator built into my phone. Or the authenticator built into my desktop. Or the authenticator built into my laptop. Or my other authenticator. My phone was destroyed not too long ago. I had been using it for passkeys. Oh no, all those passkeys were gone. No problem, when I got my new phone I just used the authenticator on my keyring to get back into my accounts. If my keyring authenticator got lost I'd just buy a new authenticator eventually and add it to my accounts. | | | |
| ▲ | brendoelfrendo 5 hours ago | parent | prev [-] | | I open the safe where I keep my spare Yubikey. Or I use the passkey stored in my phone, or the one on my laptop. Make passkeys, put them everywhere. |
|
|
| |
| ▲ | bonoboTP 6 hours ago | parent | prev [-] | | Exactly. All these ideals work in theory but then in reality banks are also incompetent and will use all kinds of domains. Same with meta and Google where they often direct you to domains that aren't under their main one and it's actually legit, but there's no way to know. It's impossible to teach family members to pay attention if it's really that domain because it's often legit not that domain. |
|
