[HN Gopher] Help users log in across affiliated sites on Chrome
       ___________________________________________________________________
        
       Help users log in across affiliated sites on Chrome
        
       Author : feross
       Score  : 16 points
       Date   : 2021-04-22 17:17 UTC (5 hours ago)
        
 (HTM) web link (blog.chromium.org)
 (TXT) w3m dump (blog.chromium.org)
        
       | CSSer wrote:
       | Across three different commercial, business-grade and feature
       | laden password managers, I've always wondered why none of them
       | offered a solution to this. Perhaps because it could encourage
       | what is effectively a bad security practice/habit?
       | 
       | It's a smart move by Google, provided devs/engineers set it up,
       | too; it's yet another feature to maintain browser market share
       | dominance.
        
         | noahtallen wrote:
         | Not exactly as automatic, but 1Password lets you add multiple
         | URLs to an entry. Then, autofill will work with the same entry
         | across multiple domains.
        
         | encryptluks2 wrote:
         | I would never recommend users save their passwords in their
         | Browser password manager.
        
       | modeless wrote:
       | Of dozens of Android apps on my phone that have an associated
       | website, I think only one or two actually work with password
       | autofill correctly across both. People just aren't bothering to
       | set up DALs correctly. I doubt this will change that.
        
         | jeroenhd wrote:
         | I have never even heard of these and I doubt most programmers
         | ever have. The feature also seems very easy to abuse for
         | password exfiltration if you can sneak in some reflective XSS.
         | 
         | This seems to be a very Google-exclusive standard, the
         | documentation website literally has "Google Digital Asset
         | Links" in the title.
        
           | encryptluks2 wrote:
           | Right, unless both domains require that you link them
           | together. Otherwise, what is to stop some domain from saying
           | they are linked and then capturing your login info?
        
         | weird-eye-issue wrote:
         | Almost all my Android apps work with LastPass
        
           | Larrikin wrote:
           | I think his comment refers to the feature in 1password
           | (probably others) that will automatically pop-up associated
           | passwords as opposed to finding them within all your
           | passwords. I had no idea it was possible to link a website
           | and app together in this way.
        
             | weird-eye-issue wrote:
             | Yes and that is what I'm referring to with LastPass...
        
       | saagarjha wrote:
       | The use of DALs to cross eTLD+1 lines is interesting, I wonder if
       | we'll see it more in the future to link websites.
        
       | encryptluks2 wrote:
       | I think where Chromium messed up is that rather than hand off
       | their Password Manager, Bookmark Manager, and other sync
       | capabilities they decided to roll their own and they just aren't
       | that good. Rather than bookmark managers and password managers
       | being able to integrate directly into Chromium, they instead
       | require a separate extension. Maybe it is for the best, but with
       | 0-day exploits becoming more prevalent it is starting to look
       | like the best solution is to not save all your passwords in your
       | web browser.
        
       ___________________________________________________________________
       (page generated 2021-04-22 23:02 UTC)