this post was submitted on 26 Apr 2024
21 points (100.0% liked)

Open Source

31224 readers
366 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] jet@hackertalks.com 4 points 6 months ago* (last edited 6 months ago)

That's down to you and your threat model. Look at the downside of a breach, and look at the convenience of the browser integration. And make the choice for yourself.

For instance, if I was logging into a top secret military system, I would not use browser integration. That would be outside my threat model

Not to mention copy and paste on many systems is very insecure. On desktop computers any application can copy from that buffer without you being aware of it. On telephones are getting better about letting you know when an app copied the copy and paste buffer. But it's something you should model

If you decide to type the password in manually, what else is listening to your keystrokes? If you're running discord with a push to talk button. Discord usually gets to see everything that you type. Is discord part of your threat model?

I bring these scenarios up just to illustrate that being aware of your threat model trade-offs and risk tolerance is important.