Hacker News new | ask | show | jobs
by gregod 2339 days ago
For Firefox there is https://addons.mozilla.org/en-US/firefox/addon/passff/ which I'm quite happy with.

When combined with a yubikey set to decrypt only on touch this setup has a very low attack surface compared to other browser password managers.
1 comments
tdons 2338 days ago
This used to be my approach, but it prevented grepping through my password store (you have to touch the yubikey to decrypt each password separately)

I since switched to a separate on-device key for "low value" passwords and keep the interesting stuff (e-mail pwds) under the yubikey protected key (which does requires touch).

Did you find a better solution?

link
gregod 2336 days ago
No. But i don't have an need for mass access so the basic case works fine for me. I keep a backup key on a separate yubikey that does not require touch for key maintenance.

Apparently there is a new "cached" option for the touch settings "Touch is cached for 15s after use (valid from 4.3)." Which would work for your use case but also neglect some/most? of the security advantages.

link