14
Password manager of cookies? (feddit.ch)
submitted 1 year ago by opt9@feddit.ch to c/privacyguides@lemmy.one
10 comments fedilink hide all child comments

I'm wondering if it isn't better to just whitelist cookies for the sites I need to log into and not bother with a password manager extension (keepasxc or bitwarden). I try to keep the number of extensions in my browser to a minimum to lower the attack surface. And why involve one more entity in the password story? Are there any problems with using the (1st party) cookies of sites I have signed up to and use to keep me signed in?

top 10 comments
sorted by: hot top controversial new old
[-] Knuschberkeks@feddit.de 13 points 1 year ago

well, off i understand you correctly, you want to just stay logged in and never bother with the password in your device? That comes with a heap of problems:

  • what if someone else gains access to your device, they'd have instant access to all your accounts
  • what if your device died? If you don't know the passwords you can never log in on anything else.
  • if you whitelist cookies those sites could track you across other sites, thus INCREASING your attack surface
[-] opt9@feddit.ch 2 points 1 year ago

Thanks for your response. Points 1 and 2 would be the same if I used an in browser password manager. I backup all passwords on my desktop manager and my laptop is pretty hard to break into. For point 3, do 1st party cookies track people? I thought they were mostly benign and for site settings.

[-] nottelling@lemmy.world 14 points 1 year ago* (last edited 1 year ago)

  1. No. Your desktop password manager is encrypted with a strong passphrase that locks when you're computer locks. (Right?) They'd have to snatch your gear mid-session. Cookies are not safe, and cookie hijacks are a pretty common exploit. Cookies are for convenience, not security. Retaining authentication cookies is a very big security hole that we all do, and it's why banks don't let you re-auth on a previous session cookie.

  2. "Pretty hard to break into" is the kind of phrase that keeps infosec people up at night. It's the kind of phrase that reads to me as "full of vulnerabilities so I can easily break in." You probably want to read up on your security practices.

  3. Yes. First party cookies can be just as nefarious in addition to the technical requirements. Cookie managers are more relaxed about first party because we assume you're on that site for a reason, not because the cookies aren't a risk.

3a. Never assume that something supposed to be "mostly benign" isn't currently being exploited for bad reasons.

To your OP, It's actually not a terrible idea to uninstall the PW manager browser extension. It's one more layer of isolation from the browser. You just lose the convenience of autofill.

But definitely rely on the PW manager for session security and not cookies.

Edit: a couple edits.

[-] opt9@feddit.ch 3 points 1 year ago

Thanks, I will be deleting all cookies and using my desktop keepassxc.

[-] nottelling@lemmy.world 3 points 1 year ago

You really don't need to be that paranoid for personal stuff. Use a cookie manager extension like NoCookie, NoScript, uBlock Origin, and isolate with Firefox Containers.

The idea of an "attack surface" from extensions is valid enough, but you can improve your overall security posture with more good extensions thanv trying to manually maintain everything yourself.

[-] furrowsofar@beehaw.org 3 points 1 year ago

No, one and two are not the same. Your PM is not unlocked unless you enter that master password and it will lock after some time period. Many common PMs sync too. Plus you should be using 2FA. If you care about security avoid auto login.

[-] opt9@feddit.ch 1 points 1 year ago

Yeah, I was thinking of browser PM with auto signin. But I'm dropping all that now. I wonder why these privacy and security focused browsers like Brave include options like this if they are bad for users.

[-] Cube6392@beehaw.org 3 points 1 year ago

I use a desktop password manager and don't bother with an extension most of the time

[-] opt9@feddit.ch 1 points 1 year ago

This is what I was doing before I switched to cookies for convenience. I will be going back to this now.

[-] merde@sh.itjust.works 1 points 1 year ago

in that case i install 2 browsers. One that they use for the sites they need to login (with 3rd party cookies disabled), another with higher security preferences and blockers for general browsing

this post was submitted on 27 Jul 2023
14 points (100.0% liked)

Privacy Guides

16263 readers
4 users here now

In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.

This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.

You can subscribe to this community from any Kbin or Lemmy instance:

Learn more...

Check out our website at privacyguides.org before asking your questions here. We've tried answering the common questions and recommendations there!

Want to get involved? The website is open-source on GitHub, and your help would be appreciated!

This community is the "official" Privacy Guides community on Lemmy, which can be verified here. Other "Privacy Guides" communities on other Lemmy servers are not moderated by this team or associated with the website.

Moderation Rules:

  1. We prefer posting about open-source software whenever possible.
  2. This is not the place for self-promotion if you are not listed on privacyguides.org. If you want to be listed, make a suggestion on our forum first.
  3. No soliciting engagement: Don't ask for upvotes, follows, etc.
  4. Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
  5. Be civil, no violence, hate speech. Assume people here are posting in good faith.
  6. Don't repost topics which have already been covered here.
  7. News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
  8. Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
  9. No help vampires: This is not a tech support subreddit, don't abuse our community's willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
  10. No misinformation: Extraordinary claims must be matched with evidence.
  11. Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
  12. General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.

Additional Resources:

founded 1 year ago
MODERATORS
jonah@lemmy.one
dngray@lemmy.one
freddy@lemmy.one
ninchuka@lemmy.one
jonah@lemmy.jonaharagon.net