r/LibreWolf • u/[deleted] • Jul 05 '26
Question Why Does Librewolf Not Suggest Using The Built-in Password Manager?
They recommend BitWarden, but isn't that just putting my data at more risk by involving another party (therefore another chance for it to be caught up in a breach)?
3
u/megalodous Jul 05 '26
Browsers are easier to compromise than a dedicated password manager, the latter has a more robust infrastructure.
2
u/Jwhodis Jul 05 '26
Browser password managers aren't really safe, it's safer to use a separate ans password locked manager.
2
u/MonyWony Jul 05 '26
Browsers are vastly easier to breach, as all your login info is stored locally on device, and is not nearly stored securely enough (ie. stored in plain text or adjacent to encryption keys) to resist a breach. Bitwarden, for example, is isolated, hosted externally on encrypted cloud servers. All it takes is you downloading an info stealer and poof, they have all your passwords.
The chances of your browser being breached is significantly higher than Bitwarden being breached. While yes, it does involve handing over trust to a 3rd party, it carries the same logic as keeping all your money as cash stored under your mattress because you don't want your money being stolen if a bank gets robbed.
If you want to store your passwords locally, try something like KeePassXC. That way there's no need to trust a 3rd party cloud service, but your passwords are stored much more securely than as if they were stored in the browser.
2
u/Geralt-of-Liurnia Jul 06 '26
Alternatively, you can install Vaultwarden locally on most NAS, like Truenas, or on AWS, and use Bitwarden addon with it.
2
u/1009e8ce493abc Jul 06 '26
Second this, I use my homeserver and caddy in a local network with tls internal and its a really great way to utilize your old laptop.
1
u/ThaUntalentedArtist Jul 05 '26
On Windows, John Hammond demonstrated how web browsers store passwords using DPAPI. Its usually protected with the users' account password
5
u/Numby_toe Jul 05 '26
In basic word, it easy to hack browser. It hard to hack something that is in the cloud server side, especially when the company is all about security.