Comment on Password ChartparentComments−dfranke16y> even looks like it's in JS to prevent most MitM attacks!The JS is delivered over cleartext HTTP. A MITM attack can substitute malicious JS code that will deliver your password to a third-party server.−bgraves16yNot if you just save the JS file to your local machine, right? There's no HTTP involved in that case (which is precisely how I intended to use it).−dfranke16yProvided that the code is intact when you initially retrieve it, that solves the MITM issue. But then you're tied to that computer, and if that's acceptable, then you're far better off just using a password-keeper that uses real crypto.
Comments
> even looks like it's in JS to prevent most MitM attacks!
The JS is delivered over cleartext HTTP. A MITM attack can substitute malicious JS code that will deliver your password to a third-party server.
Not if you just save the JS file to your local machine, right? There's no HTTP involved in that case (which is precisely how I intended to use it).
Provided that the code is intact when you initially retrieve it, that solves the MITM issue. But then you're tied to that computer, and if that's acceptable, then you're far better off just using a password-keeper that uses real crypto.