<story><title>We&apos;re Baking ‘Have I Been Pwned’ into Firefox and 1Password</title><url>https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/</url></story><parent_chain><item><author>BartBoch</author><text>This. I am using LastPass for example, because it is probably only password manager, where you can completely disable auto-fill (you need to click on an input field and then pick a profile - so it is &amp;quot;on demand&amp;quot; fill) which makes automatic harvesting attacks much harder. I have switched from 1Password exactly for that reason - 1Password is very aggressive in filling input fields for you.</text></item><item><author>2T1Qka0rEiPr</author><text>I have such great respect for Troy and all the work he&amp;#x27;s done&amp;#x2F;is continuing to do to promote good security practices. I just went on HIPB though and noticed the advise for better security is &amp;quot;use 1Password&amp;quot; (after checking your email for compromises).&lt;p&gt;This just seems a little too commercial to me and I&amp;#x27;m not sure I like the phrasing. I fully understand the need for Troy to be sponsored and it&amp;#x27;s great that 1Password works well with his tooling, but it&amp;#x27;s &lt;i&gt;not the only solution&lt;/i&gt;. I&amp;#x27;d feel a little less uneasy if it was phrased in such a way as &amp;quot;Use a password manager, like 1Password&amp;quot;.</text></item></parent_chain><comment><author>cricalix</author><text>The most 1Password has ever done (in my experience) is submit after I select the login to use, even on sites with only one login. I disabled that aspect, and I always have to toggle the helper via ctrl&amp;#x2F;cmd-\. It has never pre-filled a login field without me asking it to, and that&amp;#x27;s across v4, v5, v6, and v7.</text></comment>
<story><title>We&apos;re Baking ‘Have I Been Pwned’ into Firefox and 1Password</title><url>https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/</url></story><parent_chain><item><author>BartBoch</author><text>This. I am using LastPass for example, because it is probably only password manager, where you can completely disable auto-fill (you need to click on an input field and then pick a profile - so it is &amp;quot;on demand&amp;quot; fill) which makes automatic harvesting attacks much harder. I have switched from 1Password exactly for that reason - 1Password is very aggressive in filling input fields for you.</text></item><item><author>2T1Qka0rEiPr</author><text>I have such great respect for Troy and all the work he&amp;#x27;s done&amp;#x2F;is continuing to do to promote good security practices. I just went on HIPB though and noticed the advise for better security is &amp;quot;use 1Password&amp;quot; (after checking your email for compromises).&lt;p&gt;This just seems a little too commercial to me and I&amp;#x27;m not sure I like the phrasing. I fully understand the need for Troy to be sponsored and it&amp;#x27;s great that 1Password works well with his tooling, but it&amp;#x27;s &lt;i&gt;not the only solution&lt;/i&gt;. I&amp;#x27;d feel a little less uneasy if it was phrased in such a way as &amp;quot;Use a password manager, like 1Password&amp;quot;.</text></item></parent_chain><comment><author>dzhiurgis</author><text>LastPass have a horrible security track record.&lt;p&gt;I’ve even caught them editing their wiki page, trying to erase their past, which was reverted thanks to HN.</text></comment>