Right, “maliciously sneak”, as in they’ve either gained access to make changes to the site ditectly, or they’ve found a way to inject their scripts to steal creds.
And how is that any different from not having a password manager?
Yes, if someone hijacks a domain they can get credentials intended for that domain. A password manager doesn’t make a huge difference here, because why would they make the site look any different than normal?
Serinus is asking if the site in question needs to be compromised. In other words, can the attacker compromise a random site to fool your password manager into entering credentials for Gmail.com, or does the attacker have to compromise Gmail.com to do that?
Because those two attacks are very different levels of complexity.
And frankly, if someone compromises the site you’re actually trying to visit, there’s simply no defense against that at all.
Bitwarden will only autofill if the domain matches.
Right, “maliciously sneak”, as in they’ve either gained access to make changes to the site ditectly, or they’ve found a way to inject their scripts to steal creds.
And how is that any different from not having a password manager?
Yes, if someone hijacks a domain they can get credentials intended for that domain. A password manager doesn’t make a huge difference here, because why would they make the site look any different than normal?
I guess you didn’t read most of the comment.
No, he did, here’s where the confusion is.
Serinus is asking if the site in question needs to be compromised. In other words, can the attacker compromise a random site to fool your password manager into entering credentials for Gmail.com, or does the attacker have to compromise Gmail.com to do that?
Because those two attacks are very different levels of complexity.
And frankly, if someone compromises the site you’re actually trying to visit, there’s simply no defense against that at all.