It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can’t remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don’t just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They’re not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser’s password storage is better than nothing. Don’t reuse passwords, use long randomly generated ones.
It’s free, it’s convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I’m preaching to the choir, but if even one of you decides to use a password manager after this then it’s an easy win.
Please, don’t wait. If you aren’t using a password manager right now, take a few minutes. You’ll thank yourself later.
I actually combine a password manager with a password book, don’t like storing data for sensitive accounts on servers that can be breached and I’m too lazy to self host 😬 and I can remember my password phrases for sensitive accounts I use normally.
Absolutely this. Been using KeePassDX for years and its made my life so much easier. I am waiting for it to support passkeys so i can start using them where possible.
In my experience preaching this same thing to many users at work and just personal friends, they won’t change their ways. Because “omg not another password to remember” and “that’s too much work to login just to get a password”.
I’ve just stopped trying to educate people at this point. That’s on them when their info gets leaked or accounts drained.
People are already annoyed at base that they need any 2FA at all and don’t want to deal with more info. They just tune out.
Yup, they couldnt care less about any 2FA. But then they get the surprised Pikachu face when they get breached after being phished lol.
Tell them some password managers have TOTP support. I think I paid Bitwarden $10 for life or per year for TOTP so I don’t need to use my phone.
That kinda defeats the purpose of 2fa though, if you use bitwarden for both
deleted by creator
Instead of opening Google authenticator or Authy or whatever your preferred 2FA is, you can take photos of the QR codes in Bitwarden mobile to store the TOTP codes in it, and then Bitwarden puts them on your clipboard to paste into websites
.
It works as long as you can get at the authentication key that generates the one time codes. Usually you scan a QR code, but sometimes you have to paste it in as a string.
How you get that private authentication key can vary by service. For example, you can install steam mobile on an android emulator and use an open source program to extract the private authentication key.
I am fighting this with people at work.
No, it is not “one more password to remember”
You have 2 passwords: your laptop and your Bitwarden. Forget everything else. Don’t care. Use a passphrase if you have troubles with passwords.
I even generated a sample password from bitwarden and drew them a picture of how to remember it lol
Still about 10% of people forgot their password in the first 2 months.
I don’t recommend Bitwarden. I used them in a corporate environment and they lost all of our company’s credentials. It was a huge hit that cost tens of thousands worth of man-hours to overcome. Their response was to shrug and say sorry. We were paying a premium for their services, too, and have moved onto LastPass.
deleted by creator
Agreed, but it wasn’t my decision and TBF they didn’t lose our passwords.
90% chance it was some kind of user error.
Why weren’t any backups created?
Idk, not my department.
LastPass? the one that leaked people’s private notes that were not encrypted?
second the back up question by u/@[email protected]
Right lol
I get people hating on bitwarden being hosted by 3p but let’s be real it provides a lot more benefit then risk to any normie.
if you are such a big dick security/privacy daddy, then selfhost… but most people just need a useful service. bitwarden is free for all the needs a normie would ever come with, then pro version is like 10 bucks a year.
My dad somehow believes that that password managers are very insecure ( he got that from some sort of ‘reputable source’, so me telling him bitwarden is secure doesn’t help) and he just writes down all of his completely randomly generated passwords in a notebook, which always seems really inefficient to me, especially when he writes a character down incorrectly.
deleted by creator
My wife does this with index cards. I have to try to figure out what she wrote down (1? l?) and she crosses out an old one and writes the new one in a random spot so I have to study the card to find the live pw.
He’s doing something right.
You can’t hack a paper note over the internet.You can’t grep dead trees, password managers are only as secure as their infrastructure which are constantly being backdoored, socially engineered and poorly administered. Anyone that trusts a simple security solution is a fool.
Is your dad Ron Swanson? /j
I mean he’s not wrong about paper being more secure than password manager (provided you have good physical security and trust the people you live with)
Well yeah I guess that’s true
Yes, but this is like replacing the front door of your house with a bank vault door. Yes, it’s more secure, but there is a point of “reasonably secure enough” for most people and at some point, you are just inconveniencing yourself for no tangible gain.
Only until he gets a keylogger on his computer
I always recommend Proton Pass. A) because they have a forever free version and B) because hopefully they start looking into the whole suite in general and even if they don’t subscribe, they are more aware afterwards (hopefully).
deleted by creator
whats missing, since the proton pass source code is available?
I have only found the source code for the Android and iOS application, but not for the server.
but bitwarden, keepassxc don’t pay them… RHEEEE
@Charger8232 I have been using Vaultwarden (Unofficial Bitwarden compatible server written in Rust) selfhosted for a few years now, and I have to say I’m very happy with it. I also use the backup strategy, on some media (USB stick and SSD) encrypted with Veracrypt.
Been using Bitwarden for a couple years now…
No regrets
Quick question - what are your opinions on using Firefox’s inbuilt password manager? I’ve installed Bitwarden as an extension, but I find Firefox to be more convenient.
I mostly use FF on Linux, Windows, and Android and have no issues with using FF cross platforms.
deleted by creator
Firefox has an option to set a master password, doesn’t it?
It does
I’m in the same boat. FF is just too damn convenient
Yeah, the used to have the lockwise app, which was awesome, I don’t know why they scrapped it
I use bitwarden over Firefox because it can auto fill into apps. So, my bank apps or whatever else. And I’m not tied to Firefox if, for some reason, I want to stop using it.
It’s similar to why I don’t use Samsung pass on my phone. It’d work better filling in the fields, but that’s not going to help me on my PC, and I don’t want to maintain multiple managers.
And I’m not tied to Firefox if, for some reason, I want to stop using it.
Not gonna happen.
At this point, probably not. But, at one time, I did leave Firefox for Chrome when it was new.
I mean I used to say the same but then I did after doing more research in mozilla’s privacy things. Also Ladybird is coming at some point and frankly can’t wait for that
It does work with apps on Android, you just need to replace the default system password manager with it. Although my bank does use a complicated password system that cannot be used by password managers.
Don’t. It’s not in your hand is the simple reason.
My advice is keepassxc. Got a ff-addon that does basically the same. But you have your password-file under your control. And do backups!
What permissions does the extension need to work? Then, what is the maximum level of damage a malicious update to said extension can do with those permissions?
I don’t know. You wouldn’t really need it, if you’re concerned. If you’re fine you can just C&P or even let keepassxc use it’s auto-type. So no addon needed. It’s just more comfortable. And you can never have security AND comfort. Security is absolutely always uncomfortable.
Firefox password manager is brilliant, my move to Bitwarden wasn’t worth it and I regret it.
Whatever solution you think you can come up with is most likely not secure.
Having my passwords written down on a piece of paper is not safe ?
Maybe it’s secure but not safe. You won’t know if you have mistaken a character until it’s too late, or when you have written it ambiguously but you still remember it and don’t notice.
Sorry for the bother, but I get a little annoyed when people try to argue semantic difference in synonyms. What do you think is the difference between secure and safe?
Security and safety are not synonymous, they have a different meaning.
Security is that your password is stored in a way that it cannot be accessed by those you don’t want. Safety means that you won’t lose access to it and that it remains usable.
The distimction may be clearer with an other example.
A factory is secure if only the employees can enter, and it is safe if it does not want to fall apart and the machines in it don’t kill the employees.
Maybe it can be generalized so that security is for the access, safety is for the mistakes and the disasters.
No. Anyone near you or with access to your place can see it. And most people know of the tricks.
Also you can’t encrypt it and most of all you can’t really generate as strong passwords as those generated by password managers, meaning I don’t even need the paper to try and crack your password
you can’t encrypt it
My friend, you will be surprised that encryption is something that not only the magical internet machine can do.
It’s still nowhere near as secure and convenient as using an appropriate tool. You will either have one that is easy to decipher and remember or one that is hard to decipher and remember. And you have to do it every time but at that point you might aswell just remember one password/passphrase and use it for your password manager, defeating the whole point.
Also bare in mind convenience is important in security, if a measure is very inconvenient you will eventually just bypass it on your own cause you can’t be arsed.
You can compute one time pads by hand on paper.
I blame the tinfoil hat infosec crowd for not understanding that the world they inhabit is not the same one Regular Users live in.
Is there risk in keeping all your passwords in one place, whether it’s on your hardware or someone else’s? hell yes! Is that risk stastically speaking ANYTHING LIKE the risk you take when you use ‘pencil’ for all your passwords because you can’t be arsed to memorize anything more complex? OH HELL YES.
Sure, if you’re defending against nation state level agressors, maybe using a password manager isn’ the wisest choice, but for easily 99% of computer users, we’re at the level of “keeping people from drooling on their shoes”. So password managers are probably a GREAT idea.
I feel like password managers are more targeted to companies where sharing and controlling login data shouldnt be logged on some table in an excel sheet.
It just so happens that a manager is also god damn convenient for the private individualI don’t think that’s always the case. 1Password started out as a personal password manager and only added the corporate/teams/families features later.
So password managers are probably a GREAT idea.
That is, when they can manage to use it.
Is ProtonPass okay?
Yes. As long as it’s secure and open-source, has all the features you need and you’re comfortable with the user interface, there is absolutely nothing wrong with it, and you should use what you like.
If you’re on Linux and you don’t want to use KeepassXC, you can check out Secrets on Flathub, it has imo a better UI/UX
If you’re on Linux and you like minimalism, pass is also a great option
Interesting, thanks for the recommendation.
is it possible to sync keepassxc between computers + phone?
tbh i just keep the master version on my computer and physically transfer it to my phone every so often. i try to avoid using too many password-requiring services on my phone.
i used to do this, until I started using syncthing
i only add password entries on my laptop then sync the file directly to my phone using syncthing to avoid conflict
Yes. The easiest/most reliable is syncthing. Yet there’s the online-component which is inherently vulnerable. Depends on how paranoid you are.
You can lock your password database with a key file (this is a standard feature in keepassxc) and transfer the key file once between devices via sneakernet (microsd or usb drive). That way even if someone intercepts your database file, AND knows your password, it is still virtually impossible to crack. Should be a good enough solution, unless you are quantum-tier paranoid
That is actually a good idea. I’m not using one rn as i only manually transfer it. Might be worth considering. Thanks
I have it synced across 4 computers and my phone. You just need a central repository. For that I use nextcloud. I suppose you could use OneDrive, Google drive, box, sync thing, or something else though.
You can keep the database on a device accessable by all of your other devices. I’m sure there are many other solutions but that’s worked for me over the years.
Syncthing has worked well for me between 3 devices(Linux, android, windows). I’ve had one conflict in 6mo and it was easy to identify the right copy to select in keepass’ prompt since the more recent one was a larger file.
Synchthing also provides optional version control which makes backing up easy.
A long time ago, I used Syncthing to do this. Sometimes there would be file conflicts, which was a pain to resolve, so I switched to BitWarden (using their server for syncing) and have been using it ever since.
Yes, but it’s a bit involved to automate it. KeePassXC has a less technical recommendation here
