from Charger8232@lemmy.ml to privacy@lemmy.ml on 14 Aug 2024 22:10
https://lemmy.ml/post/19156372
It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can’t remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don’t just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They’re not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser’s password storage is better than nothing. Don’t reuse passwords, use long randomly generated ones.
It’s free, it’s convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I’m preaching to the choir, but if even one of you decides to use a password manager after this then it’s an easy win.
Please, don’t wait. If you aren’t using a password manager right now, take a few minutes. You’ll thank yourself later.
#privacy
threaded - newest
Absolutely this. Been using KeePassDX for years and its made my life so much easier. I am waiting for it to support passkeys so i can start using them where possible.
You are right. However most of the mainstream YouTubers promote rubbish password managers, which is why most people I know don’t know about bitwarden. I usually recommend bitwarden or proton pass. (I’m self-hosting vaultwarden). More privacy focus YouTubers need to promote bitwarden, keepassxc etc. (I’m waiting for proton pass self-hosting option).
but bitwarden, keepassxc don't pay them.... RHEEEE
whats missing, since the proton pass source code is available?
I have only found the source code for the Android and iOS application, but not for the server.
In my experience preaching this same thing to many users at work and just personal friends, they won’t change their ways. Because “omg not another password to remember” and “that’s too much work to login just to get a password”.
I’ve just stopped trying to educate people at this point. That’s on them when their info gets leaked or accounts drained.
People are already annoyed at base that they need any 2FA at all and don’t want to deal with more info. They just tune out.
Tell them some password managers have TOTP support. I think I paid Bitwarden $10 for life or per year for TOTP so I don’t need to use my phone.
It’s $10 per year
That kinda defeats the purpose of 2fa though, if you use bitwarden for both
whats that and how can i use it to get rid of 2fa?
Instead of opening Google authenticator or Authy or whatever your preferred 2FA is, you can take photos of the QR codes in Bitwarden mobile to store the TOTP codes in it, and then Bitwarden puts them on your clipboard to paste into websites
you might have just inadvertedly sold me on bitwarden.
does it work with 3rd party sort of authentication apps? like when 2fa is inside the manufacturer app?
It works as long as you can get at the authentication key that generates the one time codes. Usually you scan a QR code, but sometimes you have to paste it in as a string.
How you get that private authentication key can vary by service. For example, you can install steam mobile on an android emulator and use an open source program to extract the private authentication key.
Yup, they couldnt care less about any 2FA. But then they get the surprised Pikachu face when they get breached after being phished lol.
I am fighting this with people at work.
No, it is not “one more password to remember”
You have 2 passwords: your laptop and your Bitwarden. Forget everything else. Don’t care. Use a passphrase if you have troubles with passwords.
I even generated a sample password from bitwarden and drew them a picture of how to remember it lol
Still about 10% of people forgot their password in the first 2 months.
I don’t recommend Bitwarden. I used them in a corporate environment and they lost all of our company’s credentials. It was a huge hit that cost tens of thousands worth of man-hours to overcome. Their response was to shrug and say sorry. We were paying a premium for their services, too, and have moved onto LastPass.
Why weren’t any backups created?
Idk, not my department.
LastPass? the one that leaked people's private notes that were not encrypted?
second the back up question by u/@Charger8232
One of many LastPass leaks
Right lol
I get people hating on bitwarden being hosted by 3p but let's be real it provides a lot more benefit then risk to any normie.
if you are such a big dick security/privacy daddy, then selfhost.... but most people just need a useful service. bitwarden is free for all the needs a normie would ever come with, then pro version is like 10 bucks a year.
90% chance it was some kind of user error.
I couldn’t imagine a worse decision.
Agreed, but it wasn’t my decision and TBF they didn’t lose our passwords.
I migrated from Bitwarden to Proton Pass (mostly due to their OTP integrations) and I am enjoying it very much. They are constantly improving it, which is also a plus.
Do you mean OTP?
I self-host vaultwarden, and I have that. I think it’s a paid feature if not self-hosting?
Oh yes I meant OTP, typo of my part.
Yes, it is paid.
To be fair, that is super fucking annoying. I hate when I tell bitwarden to save my password only to have the site come back with it being too long and only some special characters are allowed.
Clarification: They reuse the same password (such as “Password”) and whenever they create an account they have to add special characters (like “Password1&” if numbers and #@&%$ were required) and when they login they forget which special characters were required by that service, meaning they don’t know which special characters to append to their generic password to successfully login. The solution was to screenshot every password requirement for every service and still try to remember which characters were used.
But yes, there is an unrelated frustration where password requirements aren’t presented upfront.
And pinnacle of this frustration is “password too long”… Talk about security
which doesn’t make sense as a requirement, as the passwords themselves are not even (supposed to be) stored
limits of 128+ characters? Sure.
Limits of 30, 20, 18, or 16 as I’ve seen in many places? I suddenly don’t trust your website.
Steam and Spotify are notorious for this.
Do you want to know the kicker? There are banks (yes, you heard me right) that straight up don’t allow more than 20 chars. 20!!! And they say you got to use the app for X things because it’s secure and shit (e.g.: use the app to 2FA credit card transactions). Meanwhile, does not allow you to add a yubikey for Fido authentication
My favorite is the sites that silently truncate your password to a maximum length only they know, before storing it. Then when you come back you have to guess which substring of your password they actually used before you can log in. Resetting doesn’t help unless you realize they’re doing this and use a short one.
Similarly, sites that don’t handle backslashes properly. I’ve had a few where I had to use my password sans all the backslashes because it interpreted them as an escape character.
I like the password in my thinkpad’s bios that’s case sensitive when entering it to log in, but setting the password it’s not. That took me a while to figure out.
My favorite was the password set screen allowing up to 64 characters, but login fails if the password is over 32 chars.
My webhost allows passwords of all length and complexities in the password set field, but will strip $ and & on the login mask on their main website, like in the top right corner.
A failed login will automatically bring you to a dedicated login.xxx.yyy subdomain and prompt a password reset, but if you use the login mask there instead, the exact same password works.
Login and password set/reset forms being out of sync is a classic. 😆
I haven’t seen that one in a while luckily.
That sounds too completely absurd to be real, which is why I believe it. Yikes.
Reddit used to silently truncate passwords. I can’t log in to my original account because they “fixed” the issue at some point
Omfg, one of my banks did this to me and was infuriating. I was able to call in to fix it and made a bug report, but goddamn, what idiot silently truncates the sign up password but not also the login form?!?
max.levch.in/post/…/shamir-secret-sharing
www.youtube.com/watch?v=MzescXc5SW0
True but doesn’t a new password then prompt bitwarden for you to update the credentials ?
My password manager is
Couldn’t be easier, couldn’t be safer.
Why?
Why would I use a password manager when this is much simpler and less error-prone?
Nothing about this is simpler than just using a proper password manager.
One must imagine skill issue.
I suggest looking at how many dynlibs your password manager links against and tell me it’s “simpler” again.
Replying to this pretentious comment for the sake of others reading this:
Run
history | grep genpasswdfor why this is not a good password storage solution. One must image skill issue.If you think the CLI is the cool kid way to go, use www.passwordstore.org, but tbh I don’t recommend that either.
Replying to this pretentious comment for the sake of others reading this:
I have history disabled in my shell, and unless your shell logs to a file, the password stays in memory.
1337
I always recommend Proton Pass. A) because they have a forever free version and B) because hopefully they start looking into the whole suite in general and even if they don’t subscribe, they are more aware afterwards (hopefully).
I’ve been using Firefox’s built in password store, plus 2fa for sensitive accounts when possible. Are there any known issues? Uploading all my passwords to someone else’s server sounds silly.
KeePassXC is entirely local.
LastPass (ironically) explains this best: blog.lastpass.com/…/why-you-shouldnt-store-passwo…
Thanks but the LastPass article is partly inapplicable and partly marketing. The one good point it makes for non-corporate users is about leaving your browser open where attackers can access it, say at the office. For a while I tried using a FIDO2 token but they weren’t well enough supported at the time. Maybe that is easier now.
I guess the reasons I would make would be not all accounts are web-based, and using a browser for anything other than browsing is a bad idea. Browsers aren’t exactly focused on keeping passwords safe, so why not use a tool designed for it? Don’t keep all your eggs in one basket
P.S. Yes, FIDO2 is much more supported
I guess I use a few APIs with auth tokens that are like passwords but I don’t see how a password manager would help. Yeah the tech for this stuff could be better, but vendors keep messing it up.
What about your Lemmy account?
On my laptop I use the Firefox password store. On my phone I mostly use Voyager which presumably stores the password in a protected app file. It could probably be extracted by rooting the phone but that has gotten harder to do, and anyway it’s also in Firefox on the same phone. Voyager is basically an API client. I can see some interesting ways to improve this but haven’t cared enough.
Theoretically, it’s possible to store a encrypted database on someone else’s system in a way where they never have the ability to see its contents, as you encryption and decryption only ever happens in the client on your devices.
Whether this is actually done in a way that enforces that on various password managers is unknowable with proprietary code.
Personally I self-host vaultwarden. All the benefits of syncing my passwords across devices, but the server enabling that, runs on my hardware.
To use that remote encrypted db, you need a stored client side secret, and a customer service department that deals with users who have lost that. See also “mud puddle test”.
I’d not heard of the “mud puddle test” but I immediately thought that any provider that does that, is doing it wrong.
Unless there’s an exploit of which I’m unaware, my self-hosted solutions pass the mud puddle test.
Companies have to know about the mud puddle test, but then they have to make an informed decision about whether they want to pass it. Hard disk and data recovery companies have been known to employ grief counsellors to help their customers cope with finding out that their disk drive is too trashed for the data to be restored. Choosing to fail the mud puddle test puts the password manager company in the same position. Some customers may, in fact, expect that recovering from the mud puddle is one of the services they are paying the company for. It’s the same reason hosted databases like RDS are a thing. Either way though, the company should be transparent about how they handle this question.
I agree with all of that, I was just pointing out that “uploading all your passwords to someone else’s server” can be done in a way that isn’t silly. You’re preaching to the choir.
Though even then, the best way is for that server to be yours, not someone else’s. And it does come with advantages in terms of convenience.
The benefits of having my passwords on a server (even my own server) seem tiny compared to just occasionally having to type one into a second computer after generating it on the first. If I had used a dozen computers instead of two, maybe it would be something to think about.
I don’t understand.
You only use each passwords once? You never log in to things on a new device without the one on which you created the account on hand? You only ever need authentication on two devices?
I own half a dozen devices on which I might want to log into places, and on several occasions it has been extremely useful to be able to access my password database from a completely new device from anywhere in the world, with nothing but the memorized master credentials.
I don’t think you can argue that the advantages don’t exist, even if they aren’t useful to you personally.
For web browsing I use either my laptop or my phone, two devices. I could imagine having more but for now there are just those two.
Firefox Sync is end-to-end encrypted. So Firefox’s password manager with syncing does this.
Changing passwords is almost always completely useless, and requiring it dramatically weakens security.
What’s the logic behind this statement? I would’ve thought that if a website’s logins and passwords were somehow leaked, the more often I change my password, the less likely it is for the leaked password to still be usable by bad guys based on the shorter time horizon.
Leaked how? No good practice allows any way for a password to “leak”.
What rotating passwords does is ensure people who don’t use a password manager either write their password down more and more frequently, or use a weaker password with some simple changing pattern that doesn’t add anything.
Suppose a social media website has a data breach.
Okay, but suppose I use a password manager like Keepass, then does rotating my passwords not make me any safer in the event a social media website’s data is breached and ends up being sold off on the dark web?
I’m not in IT but I followed the Michael Bazzell podcast until he disappeared. Guy was a bit paranoid but there was great info there. My understanding was browser saving passwords isn’t secure, that those passwords are open to scraping from bad players. Ofc I can’t reference this because the entire body of over 300 podcasts disappeared with him.
Agree on Bitwarden and such.
Using Proton Pass was a game changer to me , I don’t have to ignore the necessity to put a strong and complicated password for security reasons anymore, Proton generate it to me and stores everything ( so I don’t need to remember which password I set for which account ) But the bad aspects of cloud services worry me a little about this: the possibility of a security breach of the service, or the possibility of not being able to access it for any reason is a real disaster if it happens… so I’m thinking of exporting my passwords to another safe place for such cases.
KeePassXC is entirely local.
I know , but won’t that affect my storage if I added +1000 password ?
It shouldn’t take up too much space. My personal password file is under 2 KB, so for you it may be 1 MB at most.
Passwords don’t take up much space.
unless your storage is a floppy disk, won’t be a problem
I actually considered sticking it on a floppy disk I have. It really is a wonder how Linux is able to recognize floppy disks immediately…
As is Windows.
Which creates issue with having to synchronize it between devices. There is always something to worry about :)
Don’t let perfect be the enemy of good.
that’s nice soundbite, i am just saying you have to be realistic. if you are aiming at people who up until now had their passwords on post-it on the monitor, switching to tool where you need to come up with some synchronization system on your own might not be what convinces them.
Exactly, so use Proton :P
even if their servers were compromised it’s all encrypted. it only decrypts on your end
I’m also using ProtonPass, and I agree it’s a game changer. I love the interface, the Android app is amazing and well integrated.
To not be locked in into ProtonPass in case of real disaster, once a month I export the ProtonPass data and import to KeepassXC in my local machine. It’s pretty easy, you just have to export to CSV, and import into KeepassXC, the interface will help you to map the CSV fields accordingly, and you will have a local accessible backup in case of disaster. Don’t forget to remove the CSV from your computer after importing to KeepassXC.
You can export all your passwords to an encrypted and password protected file. I ocasionally back it up to a USB device so that I always have an offline copy available.
Still, one of these days I was logged out of my proton pass on Android and couldn’t connect to the internet. I was locked down.
I store my master password on a sticky note attached to the bottom of my desktop’s power supply. Easily accessible if I were to die, but sufficiently secure that if it were physically compromised I would have significantly worse problems on my hands.
I was in the US Air Force for 20 years, working as an IT guy, and our computers were so locked down, you couldn’t use password managers at work. Nor were you allowed to bring them in.
Almost every office I worked in was secured; no removable electronic devices allowed. No cell phones, no flash drives or removable drives. Heck, CDs were a controlled item. You had to check with a security manager for approval before bringing in a music CD, and and data CDs required a log of their use and physical control by a trusted agent.
Plus, the computers themselves had a custom-configured OS and you couldn’t install any software on them that wasn’t on a pre-approved list. Half the time, normal users needed to talk to an admin like me to install something, and I might not even have the rights at my level to do it.
I didn’t get to mess around with password managers until I retired a couple years ago, and they’ve been a game changer! In the military, we needed unique complex passwords for everything, can’t reuse passwords, can’t write down passwords, and you had to change them every 60 days.
Having a password manager makes my personal accounts so much more secure. I can have super complex passwords for everything and not need to remember them. I currently have Proton Pass (been de-Googling my life and switching all my stuff over to Proton lately) and it’s been wonderful.
I don’t know why the military doesn’t get some sort of password manager approved for use. This is far more secure than what they’ve been doing in the past. I had 3 standard password templates, then made minor changes to them for every unique account. If they got too complex, I’d forget them (and again, we weren’t allowed to write them down). Now I can just auto-generate a 25+ character complex password and I don’t even need to remember it. I love it!
The DoD actually did a study I thought “recently” on password security and found that changing passwords every X days lead to more insecure passwords since people would create shorter, easily changeable passwords that follow a very easy to crack pattern.
Don’t think they changed their policy though.
I work at a university IT department. It’s been a struggle with our auditors to loosen up the password expiration requirements. At least with the students they let anyone with 2FA to go without password expiration, which acts as a nice little carrot-and-stick. But for staff it’s two years (2FA always required), regardless of password quality. I’d rather be able to base password expiration on password quality, personality.
2 years seems perfectly reasonable. I thought you were gonna say every 30-60-90 days.
This is crazy to read, thanks for sharing! How did you store/remember all the passwords?
What’s wrong with a password manager built in the browser?
That’s what I’ve resorted to, but I only use Firefox because it has a master password.
Chrome has no master password so what stops any fool from stealing your passwords while you’re taking a piss, I don’t know.
Password managers always cause me headaches, though, and never want to integrate correctly. More trouble than their worth in my estimation.
Chrome has no master password option?! 🤮
Honestly nothing. I recommend this to everyone because it is the easiest way to set up and offers huge advantages.
I think these are the two biggest benefits and every browser password manager will accomplish both.
This is what I do: I use my browser to store all my randomly generated passwords. If I ever need them on my phone I either sync or go to my desktop and view the password and type it over.
I like using Bitwarden since it lets me input passwords for various apps on my phone as well as my other devices. Using one built into your browser seems fine as long as the passwords are stored securely.
so is it bad to store my 2FA backup codes as notes in those same login’s bitwarden entries?
It depends on your threat model. It does mostly reduce the benefit from 2FA, but you are probably still very safe if you use a random password per site. I mostly use 2FA when forced (other than a few high-value accounts) so I don’t worry about it. For most people having a random password which is auto-filled so that you don’t type it into the wrong site is more than sufficient to keep themselves secure.
I do this too. I would need them if I lost my phone, so bitwarden/keepass is a good place for them to be.
I think it is less secure though since someone who somehow has the unencrypted vault without your 2FA device could get in with the codes - but if someone cracks my master password I’m screwed in a whole bunch of ways so I’m not sure it matters too much at that point.
Say, what are the chances either
or
Keepass is file based, it is up to you to backup the file, for most users putting it an auto-synced cloud drive folder is their best bet. It’s automatic, multi-platform and offsite. Many technical users use sync thing (or equivalent) to manage the file across multiple backup locations.
KeePassXC is essentially a GUI for KeePass datbase, like word and openoffice can both open a .doc file, multiple programs can open a keepass file. If KeePassXC dies, theres others options for opening the file.
That being said, IOS options suck, theres one called Strongbox that is, in my opinion, the best. Its not FOSS like the others. Free version works 100% no problems, but they ask a high $20/yr sub or $90 lifetime for a handful of nonessential features (I’d love an decent alternative if anyone has one).
For Android I like KeepassDX and Keepass2Android.
Realistically, if you’re the specific target of a hacker going specificaly after your database files you’re best off freezing your credit and bank accounts.
If your database gets hacked, there are a few ways you can midigate the damge, its up to an individual to balance convince and security.
First is 2fa. Keepass works great for TOTP 2fa, with browser integrations, its a breeze signing into sites. If you want more security, you would have a seperate database file with a different master password for 2fa. Now a hacker needs to crack 2 databases.
Another way to midigate the risk is to seperate whatever emails you use from the main bunch, this way if the main databse gets compromised, you won’t lose the emails that let you reset everything else. If the email gets cracked, they won’t have a convient list of accounts to go mess with. Also make sure the emails have all the security and recovery options available setup.
3, bonus round Finally for fincial security, don’t have your credit card saved on every site. I don’t let most of them store it all and use privacy.com for pretty much every thing these days. Set transaction limits on regularly used sites, and set up a “1-time use” card for anythibg irregular.
Even if some brakes into, for example my amazon account, they are going to find a $100 purchase won’t work. I’ll get an email and can just cancel the privacy card for amazon (I’d probably kill them all to be safe) and then work on resecuring everything.
To top it off Privacy.com it self has a dedicated credit card attached with a strict limit to midigate damge.
For privacy.com:
On credit freezes:
I was talking about the individual card limits that can be set, those definatly work.
Edit, looking my account, I too have 250daily and 1000 monthy limit. The next paragraph might be be outdated?
I know the total daily limit is “adaptive” or something set based on your spending habits. I’d prefer setting the limit myself, but it is what it is.It at least used to be adaptive because at one point it went to 500$ for me, then changed back down a couple months later.
These are real issues however they are pretty easy to mitigate, and I would say that the upsides of a password manager far outweigh the downsides.
Make sure that you are regularly typing your master password for the first bit. After that you’ll never forget it. You can also help them out by saving a copy of their master password for them at least until they are sure they have memorized it. There are also password managers where you can recovery your account as long as you have the keys cached on at least one device.
This is far, far outweighed by the risk of password reuse. This is because when a single one of the sites you use gets hacked then people will take that credential list and try it on every other site. So with a password manager there is just one target, without it is one of hundreds of sites where you reused your password. Many password managers also have end-to-end encryption so without your password the sync service can’t be hacked (as it doesn’t have access to your passwords).
Well, what if they somehow manage to get into my password manager account? I mean, it has a login, like any other account. The way to prevent it would be to have a strong enough password. Regardless, if they somehow got my main password, they’d have free access to all my credentials everywhere, and would be able to log into them as easily as I can. I mean, it is easier to secure one account well vs. however many others that the password manager can take care of. But still, a centralised hub with easy access to all my accounts feels like a one-stop shop for taking over my online life
I mean, to myself, I can deal with the consequences of my choices (as much as they can suck sometimes). But recommending stuff to other people I find complicated. I mean, I’ve gotten locked out of accounts due to 2fa (some being old and lost to time, others due to an unlucky series of events and a last minute half-assed backup) and even had to troubleshoot and/or reinstall (Linux) operating systems on my laptop (one instance of which relates to the aforementioned 2fa incident). To recommend something to someone and risk something like that, and be responsible for it… I mean, I once had to help troubleshoot a non-booting Linux machine via messages and photos during lunch out, and I myself am not an expert, so I had to online research from my phone and relay the information
These are all good points. This is why it is important to match your recommendations to the person. For example if I know they have Chrome and a Google account I might just recommend using that. Yes, it isn’t end-to-end encrypted and Google isn’t great for privacy but at least they are already managing logins over all of their devices.
In many cases perfect is the enemy of better. I would rather them use any password manager and unique passwords (even “a text file on their desktop”) than them sticking to one password anywhere because other solutions are too complicated.
As Kramer said. Levels. If tou layer your security 2 becomes a non issue. What you have, what you know, and who you are. Which plays into 1. The 3-2-1 of backup. 3 copies of the data. 2 different media. At least 1 off site. Suprising as it might be, writing a great backup is to write your password down. I have a piece of paper with my password in a lock box in my apartment, in a safety deposit box at my bank, and at my parent’s house
Is there a password manager i can use across ios and windows?
1password
Pretty much any of them.
Bitwarden
Personally, I use PassWord123! For everything. It says its a strong and secure password so why wouldn’t I use it for everything?
Its the best one to use, all password hacking tools avoid this one when they’re attacking.
Been using 1Password for 6+ years and I probably won’t use anything else ever. My wife and I both use it and have a shared family vault for things we both use. I couldn’t live without a password manager.
My sell on password managers is quality of life. You never have to reset your passwords and you can use a hotkey to enter it faster than typing. Gone are the days of fat fingers.
But I get where people have an issue. It’s one point of failure vs. many, but they don’t realize It’s easier to well secure the one than it is to not spread the same vulnerability everywhere.
Honestly as someone who has helped family members set up a password manager one person felt this way and the rest are just not tech savvy. All the simple straightforward stuff took ages because they had never done it before.
Self-hosted bitwarden. Highly recommend
VaultWarden is a damn godsend.
I self-host a lot of stuff. But password manager just feels risky to me. Like what if I mess up and lose all my data or something.
With bitwarden being encrypted and all I just didn’t see any down side to using their server. Plus more convenient since I don’t have to VPN to use it. Or open a port.
All of that just to ask. Am I missing something? Should I be self-hosting it? I wondered about using both so I’d have a backup ether way. Or in case their servers go down for awhile. But that’s super rare.
It’s free and fun for me. I wanted to learn docker and various networking stuff. For normal end users, I don’t think there’s any benefit like you pointed out
???
Yeah, true story. Really weird.
I really want to know what the logic behind their thinking was…or maybe they were just lazy? I don’t know, it’s so weird that they’d get to the point of using a password manager but then still make such a basic error.
Marginally better than using discord itself as your password manager (also a true story!)
How does this work? Do they ask other people to remember their passwords?
Some people keep journal servers where it’s just them in a server alone, could be that
yes, it’s that.
But I wanna tell people my master password to my pw manager. It’s such a fantastic password that no one could ever possibly guess I would have. I wanna gloat.
is it possible to sync keepassxc between computers + phone?
Yes, but it’s a bit involved to automate it. KeePassXC has a less technical recommendation here
A long time ago, I used Syncthing to do this. Sometimes there would be file conflicts, which was a pain to resolve, so I switched to BitWarden (using their server for syncing) and have been using it ever since.
Syncthing has worked well for me between 3 devices(Linux, android, windows). I’ve had one conflict in 6mo and it was easy to identify the right copy to select in keepass’ prompt since the more recent one was a larger file.
Synchthing also provides optional version control which makes backing up easy.
You can keep the database on a device accessable by all of your other devices. I’m sure there are many other solutions but that’s worked for me over the years.
I have it synced across 4 computers and my phone. You just need a central repository. For that I use nextcloud. I suppose you could use OneDrive, Google drive, box, sync thing, or something else though.
tbh i just keep the master version on my computer and physically transfer it to my phone every so often. i try to avoid using too many password-requiring services on my phone.
i used to do this, until I started using syncthing
i only add password entries on my laptop then sync the file directly to my phone using syncthing to avoid conflict
Yes. The easiest/most reliable is syncthing. Yet there’s the online-component which is inherently vulnerable. Depends on how paranoid you are.
You can lock your password database with a key file (this is a standard feature in keepassxc) and transfer the key file once between devices via sneakernet (microsd or usb drive). That way even if someone intercepts your database file, AND knows your password, it is still virtually impossible to crack. Should be a good enough solution, unless you are quantum-tier paranoid
That is actually a good idea. I’m not using one rn as i only manually transfer it. Might be worth considering. Thanks
Unless you really really need portability between devices, paying for an online password manager is idiotic in my view, you’re generally just waiting for someone to hack it (which happens all the time).
I use firefox’s local, inbuilt manager and that’s everything I need.
Wild ass comment.
Who doesn’t??? What do you do, copy 20-char randomly generated passwords manually all the time? That’s the whole point of password managers…
Browsers are NOT a secure storage for sensitive data, if you want a local password manager at least please use KeePassXC.
Why is Firefox not secure storage?
Is there manager than create password based on masterpassword and domain/username? Do not want to lose all password just because drive dies. Do NOT want to use cloud anywhere.
backups backups backups.
keep a copy on your computer, your phone, and every spare drive u have in the house. ask a friend to store the file at their place.
also, whats wrong with a cloud provider, if the file is encrypted ?
Encryption won’t last forever. The moment Quantum-computing will be a thing, all current encryption will be pointless. Depends on your level of paranoia and planning for the future 😁
I mean, you can change your passwords later on if you think a quantum computer broke them. In the case of quantum computers your network traffic is also gonna get cracked anyways, so they can steal your account information through that as well.
One can’t hack into where there is no path into :-) Also, whatever you COULD do in the future, a version of your passes where you didn’t do it, already was in the cloud. It’s not like you delete a thing there and it’s totally gone forever.
This is not true at all. en.wikipedia.org/wiki/Post-quantum_cryptography good place to start if you’re genuinely interested. Most password managers that are worth while will be using symmetric cryptography which just requires longer key lengths to survive in the quantum age. AES256 should be fine for the foreseeable future.
Even IF there was a quantum-safe-cryptography, doesn’t change the fact, that your most private stuff is in a cloud and you have absolutely no idea what the future might bring. And if i have anything in the past decades in the IT, then it’s that there is always a past-past-something.
only some asymmetric ecryption (rsa already known) vulnerable to quantum and still need much more qbit to work good.
symmetric encryption (aes) not known to be vulnerable, but maybe in future
Cloud can go down, cloud can delete my file, cloud can be hacked and someone try crack encryption (rsa vulnerable to quantum compute in future, maybe similar happen to aes).
There’s a few. LessPass is one that has been going a few years.
LessPass and similar software has some problems. Things like you can’t simply change your master password, you must then recompute and change every site. It’s also not strictly stateless, since you need to know which password iteration you’re on and the user name. Full fledged password managers also typically provide other secret management features, like API keys, SSH keys, credit/debit cards, and identity cards.
That’s true. But they do give you easy, portable, site specific passwords. No apps or database syncing required.
If you just want to log in to Lemmy on a work computer at lunch it seems a good option to me.
Obviously, it does not store password, only create them.
Then they not password manager, they secret manager. With maybe random key generator.
If you use a deterministic password manager, make sure you make your master password strong
Syncthing!
I use KeepassXC and sync my DB to my phone/laptop/desktop and backup to my server.
No db, only get password from master and domain/username.
I understand, but to solve the drive death issue, there are existing solutions which are easy and free.
I know, but not answer to question.
And also set-up SSO/LDAP in your homelab if you run one so you don’t have 3000 loose outdated account entries for IPs like 192.168.10.5 user: admin password:*****
Except a lot of homelab software doesn’t support things like LDAP
Quick question - what are your opinions on using Firefox’s inbuilt password manager? I’ve installed Bitwarden as an extension, but I find Firefox to be more convenient.
I mostly use FF on Linux, Windows, and Android and have no issues with using FF cross platforms.
I’m in the same boat. FF is just too damn convenient
Yeah, the used to have the lockwise app, which was awesome, I don’t know why they scrapped it
While it’s so convenient, anyone gaining access to your browser while your laptop is open can gain access to everything. Bitwarden usually add an extra step to unlock it (which you could disable if you want) when you want to use the extension. By the way, it has an extension for Firefox, so just hitting Ctrl + Shift + L it auto-fills the login/password fields of your login page just like firefox would. But with the extra step that gaining access to the browser doesn’t straight away unlock all your passwords for anyone to see.
Firefox has an option to set a master password, doesn’t it?
It does
Don’t. It’s not in your hand is the simple reason.
My advice is keepassxc. Got a ff-addon that does basically the same. But you have your password-file under your control. And do backups!
What permissions does the extension need to work? Then, what is the maximum level of damage a malicious update to said extension can do with those permissions?
I don’t know. You wouldn’t really need it, if you’re concerned. If you’re fine you can just C&P or even let keepassxc use it’s auto-type. So no addon needed. It’s just more comfortable. And you can never have security AND comfort. Security is absolutely always uncomfortable.
I use bitwarden over Firefox because it can auto fill into apps. So, my bank apps or whatever else. And I’m not tied to Firefox if, for some reason, I want to stop using it.
It’s similar to why I don’t use Samsung pass on my phone. It’d work better filling in the fields, but that’s not going to help me on my PC, and I don’t want to maintain multiple managers.
Not gonna happen.
At this point, probably not. But, at one time, I did leave Firefox for Chrome when it was new.
I mean I used to say the same but then I did after doing more research in mozilla’s privacy things. Also Ladybird is coming at some point and frankly can’t wait for that
It does work with apps on Android, you just need to replace the default system password manager with it. Although my bank does use a complicated password system that cannot be used by password managers.
Firefox password manager is brilliant, my move to Bitwarden wasn’t worth it and I regret it.
How do I convince my girlfriend to stop using her safari password manager and migrate it to bitwarden? Is the password manager in Safari so unsafe that it’s worth the additional effort she might ask.
Apple is releasing a more comprehensive password manager in the next few months, if she’s heavily in the apple ecosystem the switch could be pretty convenient
Obviously bitwarden or keepass would be great but this would be a bump up from being stored in a browser
Thanks for the update! I will keep an eye out
My understanding is that your GF will be using Apple’s KeyChain, which is pretty good except that it’s hard to look inside and manually edit. It’s not just in Safari.
The upcoming Password app is just a nice user interface to KeyChain. So no change to the functionality as such, but I think it’ll make a big difference to how it’s used.
It’s actually pretty easy when you’re on a Mac. They bundle an app called Keychain Access, which lets you look at and edit everything.
Yes, that’s true. Keychain Access helps a lot.
It’s not that bad, but tell her that she can set Bitwarden as the default option for auto-fill in the settings and everything will get automatically filled in, just like with the normal Safari password manager
i dont understand this post. like every browser has a password manager, why install some 3rd party you can even trust less?! am i missing something? doesnt safari have a password manager? is keepasscx really safe (CVE-2023-32784)? or bitwarden (blog.redteam-pentesting.de/2024/bitwarden-heist/)?
Bitwarden exploit was already patched. And required a domain joined PC with Windows Hello active, and the attackers already had access to the DC. Not exactly a large vector. Also enterprise PCs shouldn’t be using windows hello to begin with, IMO. Now if we look at CVEs affecting browser password managers, there are literally exploits for download on GitHub.
With keepasscx YOU have the password-file. Period. You know what’s been done with it: Nothing, as it doesn’t phone home except update-checks. Which you can also disable.
With the browser-addon you’ll get the same result but with control.
In-built password managers for browsers are straightforward to crack. Like… Terrifyingly easy. It’s much better to use something like Bitwarden, Vaultwarden if you don’t trust Bitwarden, 1Password if you really want the reassurance of paying someone for trust, or KeePass if you don’t trust anyone at all (I, personally, fit into this category).
show me an example of the firefox password manager being “cracked”. i mean i still sync them into my local nextcloud. @Dyskolos@lemmy.zip suggests it is cool to have your passwords in a file?!
doubt there is a scenario where using MORE services makes anything safer. Well maybe for Windows Users…but thats a dying species with the win11 crap.
so no. third party corpos…the worst.
Sure yeah. I think corpos suck, too. That’s why I don’t prefer 1password. But Firefox puts their passwords into a file, too (two actually). Key3.db and Logins.json, both with known locations, and encrypted using AES-256-GCM which is… Decent but I prefer to go a little more hardened. The thing with keepass is the following:
But I want to make it abundantly clear. @Dyskolos@lemmy.zip has not recommended storing your passwords in a file. They have suggested storing your passwords in a mechanism that can be as secure as your hardware is capable of securing and keeping the location of that up to your own decision making.
But also. Promise me this. If you’re going to keep using Firefox as your password manager:
I dunno where you got that shit, but i never suggested to use a file or whatever. I’m keepassxc-user.
If you’re on Linux and you don’t want to use KeepassXC, you can check out Secrets on Flathub, it has imo a better UI/UX
If you’re on Linux and you like minimalism, pass is also a great option
Interesting, thanks for the recommendation.
Is ProtonPass okay?
Yes. As long as it’s secure and open-source, has all the features you need and you’re comfortable with the user interface, there is absolutely nothing wrong with it, and you should use what you like.
just. write it down? in a notebook? keepassxc is rly good if you dont want to do that though
This is not a real solution. You’re supposed to have a unique password for everything. Managing that notebook would be an hassle, not to mention backing it up. It would easily have dozens of records, if not hundreds.
oh shit fair enough!! i use temp-mail.org for most things so i frogot about accounts for every tiny service lmao
But what if you lose the notebook? Or just don’t have it on you, when you need it? God help ya if someone malicious gets it. Keep it digital, always available, backed up, and secure.
On the plus side, the more people who don’t use password managers the more chance us password manager users will remain not worth the effort.
It’s kinda like security through obscurity mixed with only having to be faster than the slowest person to outrun a lion.
I disagree. Password managers are still target of threat actors, a juicy one at that, but it’s not too often you hear of breaches of good password managers. Chances are the people behind the good password managers are better at security than 99% of users (including more technical ones). Even after a breach exporting all the passwords and moving them to another service, and changing all your passwords again with more secure ones is trivially easy.
If everyone used them sure there’d be more pressure on said password managers but hackers will find it a lot more difficult to hack anything in general and it will still not be worthwhile to hack average users who use a password manager.
I have been using password gestoires for a long time. First LastPass, until I switched to GNU/linux and discovered Keepass and then KeepassXC… For me they are indispensable. That’s the one I used until about 1 year ago when I started having problems with the Firefox addon. It did not recognize the pages. I tried ProtonPass and I like it, but I don’t like having them online, no matter how secure the site is. I’ve tried going back to KeepassXC, locally, but the file I export from ProtonPass won’t load in KeepassXC. I feel stuck.
Translated with DeepL.com (free version)
Did you export ProtonPass to CSV?
Yes, I export to CSV but when I import in KeepassXC, only one column appears.
Open a bug report in KeepassXC’s repository, maybe it’s a big in their code. Or they’ll tell you that the bug is in proton pass, and you can report it there too so that they know about it and can fix it. Maybe the KeepassXC team can give you a workaround too
My English is very poor for technical explications… I search the issue in KeepassXC Github but I don’t found similar solution.
Proton Pass is a pretty new service, maybe there haven’t been much users yet who have moved to KeepassXC from it. I would say give it a try, it’s not that bad.
Something else you could try is:
a) check the Bitwarden repo if anyone had a similar problem as you. If so, it’s more likely that it’s a Proton Pass problem, and maybe they have some tips.
b) import your Proton Pass export to another password manager (Bitwarden, original Keepasd), export it from there, and try to import this in KeepassXC. Though this might have a higher chance of losing some information, in the sense of metadata. If you go this way, don’t forget to make a fresh export of your Proton Pass account, in case you have changed something there in the meantime
I’ve been using Proton Pass and it has been a game changer for me. Hot take: I think Proton Pass is Proton’s best service.
It creates not only a unique password for each service but also a unique email address alias. If a website leaks my email address and I get spam, I know exactly who did it and I only need to swap 1 login credential.
Has a built-in 2FA and passkeys. Works great in the browser with proper auto complete, even for the 2FA code. Works fine on Android and password in both browser and applications get autocomplete.
Proton Pass can be used by everyone, regardless of their technical level, in every device. My mom could easily use this across all her devices. I’m told Keepass is fantastic but having it sync across all her devices would be challenging for her.
Most Proton services feel kinda underbaked but Proton Pass is excellent.
If that wasn’t a scripted ad, you should go into sales.
I have worked in retail to help pay for university. It was a miserable job. Dealing with people made me a worse person.
I am very “passionate” about Proton Pass but don’t take me for a Proton chill, I have a lot of criticism about their other products.
I’m a little miffed that 2FA support is a paid feature.
I’m using KeePassXC and have no intention of switching, plus I’m paying for an account anyway, I just feel that 2FA is such an essential feature for a password manager that it shouldn’t be locked behind a paywall.
100% agree. Charging for the unlimited email alias is fine but 2FA? :/
I actually came here to echo this exact sentiment. I was on Lastpass until their first breach and then on Bitwarden both cloud and self-hosted until a few months ago when I set up with Proton. I liked Bitwarden so I put off trying ProtonPass. One weekend I set it up and ended up putting my 2FA items in as well. It feels absolutely seamless to use. The email aliasing for websites is so easy for making new website accounts. In my desktop and laptop browser the way it automatically offers to autofill the 2FA is so clean. I can’t see myself going back unless Proton gets prohibitively more expensive or the product declines in usability/security. If you are currently using Proton’s suite of apps give Protonpass a try. You can easily import from Last pass/Bitwarden and use both to compare side by side.
I don’t even understand why I need to make a password for some sites anymore. They send a code to my phone everytime.to make.sure it’s me so it seems like there’s practically no point.
2FA really stands for
2 FUCKING ANNOYING !!!
Do you not understand how much 2FA helps you? That shit is cash money.
It doesn’t help everyone equally. It assumes you (a) re-use passwords, (b) don’t protect them properly. That’s the case for most people but not all.
It’s also a protection against people who get their hands on your credentials though. You don’t really have any control over a server with your data on it getting compromised, right?
If the password is unique, there’s no risk!
Incidentally: not re-using passwords should be the only responsibility of the user. It’s impossible to brute-force a password through a login form, you need full access to the disk. So when sites complain about poor password strength, effectively they are saying “We don’t trust ourselves to keep our server safe”. Pretty insulting to blame the user for that.
Hmm. Maybe I’m misunderstanding something fundamental about cyber security, but wouldn’t a server leak give you login credentials regardless of the uniqueness or amount of use a password has? And 2FA would still protect against that?
I might have thrown my hat into a ring I have no place in lmao
Unless the website is handled by complete morons it stores credentials in an hashed format. Usually to crack this we’d use rainbow tables or wordlists of known passwords, and essentially we use every word to generate the hash until it matches.
If your password is strong and hasn’t been compromised (check regularly on haveibeenpwned) it will likely not be in any wordlists and it also won’t be easy to crack. Now, password managers can generate the best passwords because they’re completely random and very long by default so to crack them you’d have to try every possible character combination, this takes time, and specifically a time so long that statistically the andromeda galaxy and milky way will merge into one before the password is cracked (at least until quantum computers become a thing, then it’s mere minutes).
2FA helps because even if they crack the password they then need the 2FA code, which you can’t really guess or brute force and is seen on a third party app you don’t control (unless you use sms, they can spoof SIMs ro view the sms you receive and therefore degeat 2FA). It also doubles as something that alerts you that someone is trying to access your account.
Yes this clarifies things. In summary, without 2FA:
So it’s a trade-off. If everyone was in the first category, then the obvious inconvenience of 2FA would just not be worth the benefit.
Absolutely not. You should always use 2FA. Most decent password managers even make it easy for you.
While cracking a strong password is nigh impossible rn they are still vulnerable to data breaches and pass-the-hash attacks.
Literally “always”, like every single time you open a website or app? No password manager can make SMS 2FA not a PITA. As for your second point, I addressed that. What if you literally don’t care about keeping data in question private? Individuals have different threat models, different priorities and all of this is a trade-off. It’s not absolute. That’s all I was saying. Anyway, I’m done here.
2FA should always be enabled. Doesn’t mean you always have to log out of a website. It’s a massive important security feature: it saves your ass if your passwords are leaked/cracked/bypassed and it warns you that someone is trying to access your account. Apps like ProtonPass literally make it extremely trivial to fill it in, just push the button that pops up and it will autofill the 6 digit code (or copy it to your clipboard in the worst case), it’s not SMS 2FA, so you’re frankly stupid for not using it if you have that option.
You didn’t address shit, strong passwords will still be vulnerable to certain attacks even if everyone used them. This isn’t a privacy matter either it’s a security one and regardless of what your threat model is 2FA should always be part of your security, there’s a reason more and more websites and apps are pushing it, cause if you don’t force idiots to adopt it they won’t even if it’s extremely important, same reason as why we need rules to make passwords more complicated. It may be an inconvenience (very tragic for the user I know, how dare they make something that autofills and takes a few seconds of my day away from watching useful shit like brainrot and some dumb comments on my favorite social media platform) but it’s an extremely important and necessary measure.
I’ve got a random username if the stupid website/app allows it. Most don’t. It has to be your email address.
And a minimum random 20 char password for each website/app. Again if the stupid website/app allows it.
Secure your (I don’t mean you personally) fucking website/app and credentials storage and stop making your weaknesses my problem.
Most places, and all of my stupid financial websites/apps, only have phone/SMS as the second factor. And yet there are plenty of horror stories about people ‘losing’ their phone numbers.
Oh wait. There is one financial site that has developed its own authenticator app. I really expect that to go about as well as storing passwords in cleartext.
Then there’s all the shit websites/apps that I don’t give a fuck about that now insist on having 2FA set up. They’re not interested in the security, it’s just to get your email and phone number to onsell your data to whoever.
It’s fucking security theater.
“Then there’s all the shit websites/apps that I don’t give a fuck about that now insist on having 2FA set up. They’re not interested in the security, it’s just to get your email and phone number to onsell your data to whoever.”
Of everything you wrote, this one had my eyes wide. Hadn’t even crossed my mind that could be a problem. 🤦🏽♂️
I don’t think 2FA being effective needs to be mutually exclusive with being “fucking annoying” -It is a security measure after all, and the one thing security measures never are is convenient.
Good point. I guess it’s never really bothered me. It’s one of those things I’ve just come to expect nowadays.
I stand by it being cash money though. lmao
I mean, using password managers is both more convenient and more secure than 99% of things most user do to handle passwords so idk.
And some like Proton Pass also double as 2FA apps and make that trivially easy too by autofilling everything with a click
Because different layers protect you against different things. It’s like how you have anti-lock brakes, a seatbelt, an airbag, and crumple zones on your car. You don’t just have one thing to protect you.
Password is necessary for two-factor authentication. The factors of authentication are something you know (like a password), something you have (like a cell phone), and something you are (like a biometric).
An example of three-factor authentication would be this—imagine a spy going into a secret bunker. They need to scan their iris, insert a key card, and then enter a passcode before the door opens. This has all three factors of authentication; the passcode is something they know, the key card is something they have, the iris scan is something they are.
If it just sends a code to your phone, that’s one-factor authentication (something you have). Anyone with your phone can get into your account. Unless, of course, your phone hides its notifications and you have a screen lock. Then that’s actually two-factor authentication because you also need to know the phone PIN or have the biometric.
If it just asks for a password, that’s one-factor authentication (something you know).
If it asks for your password and then sends a code to your phone, which you need a fingerprint or face scan to unlock, you have achieved three-factor authentication.
Edit: Interesting tidbit—in the USA, you can rent a mailbox at the post office to receive mail when you don’t want to give out your real address. Useful for privacy reasons. I’m sure they have similar things in other countries. These mailboxes come with a key. This is actually two-factor authentication, because the keys usually don’t have the mailbox number written on them! So you have to have the key and also have to know which mailbox among the hundreds at the post office it opens.
Wow, the PO Box analogy is the best, most simple way I’ve ever seen anyone explain 2FA. Thanks, I’m stealing that for when I need to explain it to my tech-illiterate family members for the umpteen millionth time :')
I blame the tinfoil hat infosec crowd for not understanding that the world they inhabit is not the same one Regular Users live in.
Is there risk in keeping all your passwords in one place, whether it’s on your hardware or someone else’s? hell yes! Is that risk stastically speaking ANYTHING LIKE the risk you take when you use ‘pencil’ for all your passwords because you can’t be arsed to memorize anything more complex? OH HELL YES.
Sure, if you’re defending against nation state level agressors, maybe using a password manager isn’ the wisest choice, but for easily 99% of computer users, we’re at the level of “keeping people from drooling on their shoes”. So password managers are probably a GREAT idea.
That is, when they can manage to use it.
I feel like password managers are more targeted to companies where sharing and controlling login data shouldnt be logged on some table in an excel sheet.
It just so happens that a manager is also god damn convenient for the private individual
I don’t think that’s always the case. 1Password started out as a personal password manager and only added the corporate/teams/families features later.
I have a password manager with a family plan so my wife can use it. Does she? Absolutely not. And that’s why we don’t share bank accounts.
Same and she has the balls to ask me for passwords!
Same here. Kinda feels good to know I am not alone with this, though.
So many folks talking about which software they use, and how they sync it between devices etc.
You all know there are hardware password keepers right? They present to your devices as a usb and/or bluetooth keyboard and just type out the user/password that you select. They have browser plugins to ease the experience. Now your password is not even stored on the device you’re using to perform your login and it will work on any modern device even without internet access.
Oh and no subscription fee to cover the costs of cloud infrastructure.
Curiously enough, I never heard of those. Do you happen to know good ones so I can further check?
I’m a pretty big fan of the mooltipass. They’re sold out and between iterations right now, but a new one is expected soon. One of my coworkers is pretty into their OnlyKey.
Mooltipass looks sick actually. I have my reservations regarding the ble part, but I would have to look into it more to understand it. Might get one to check around how well it works (once availability is there)
What happens if it gets lost stolen or broken?
That will vary from vendor to vendor. In the case of the one I like there are a few relevant things.
The password db is stored encrypted on the device. Accessing the passwords requires all of:
Three PIN failures and the smart card is invalidated.
That sort of covers “stolen” and “lost + recovered by a baddie”. Your bad actor would need to have their hands on both physical pieces and guessed the 4 digit hex code in 3 tries.
As far as a user recovering from a lost or failed device or smart card goes, you can export the encrypted version of the db for backups, which I do to a thumb drive I keep in my document safe. I do the same with a backup smart card. So that and a backup device or purchasing a new one if yours fails or is lost/stolen.
In the super “just in case” move, I also keep a keepassdb on said thumb drive. In case my device fails and it’s just not possible to get a new one. Kind of like keeping two cloud providers in case LastPass goes bankrupt or something.
Hyptothetically, couldnt an attacker clone the smart card and retry on the copies?
I would believe a salted and hashed 0-knowledge password vault is more secure than a US-company which could be forced to surrender private keys used for the encryption
How would any company, regardless of geography have the secret I generated? This is a stand alone hardware device. They seller is not involved at all once I’ve received my package.
Could a sophisticated/well resourced actor clone the smart card they stole or you lost? Sure, brute force attacks are brute force attacks. At least you’d know your device and card are stolen. Now you’re in a race to reset your passwords before they finish making 500 clones of the smart card they stole.
Hypothetically I could blackmail someone at LastPass and have a backdoor is installed for me.
Someone could bust down my door while I have it connected and unlocked and just login to all my things. ¯\_(ツ)_/¯
You lost an arm. Remember to use the
\to escape the markdown ;)I don’t know much of smart cards and the whole hardware based authentication beyond knowing they exist at all so please take my questions for what they are.
I was thinking the encryption on those cards are done with a private key and a writer/reader by the manufacturer (like HID). So if the NSA busts down the door and demands the key you could technically decrypt it.
So if you generate your own private key that vector is obviously mitigated, assuming they are providing the tool with a non-reversible hashing process or a guide on how to generate the key so it wouldn’t aid in the brure forces decryption.
Thank you for the info :)
I saw the lack of arm and facepalmed but I was half asleep poo posting so got over it :p (fixed now!)
I’ve been using this device for ~5 years now, so my memory is a little hazy on it, but I’m pretty sure for the particular device I prefer (which is to say, I have nfc what the setup is for other vendors, which could be greatly superior) the AES-256 key used for encryption isn’t generated until you setup your first card.
I save copies of the password database in several locations. I have to keep them synchronized manually but that’s preferable to using commercial ones that take turns in getting their data breached.
Having my passwords written down on a piece of paper is not safe ?
Maybe it’s secure but not safe. You won’t know if you have mistaken a character until it’s too late, or when you have written it ambiguously but you still remember it and don’t notice.
Sorry for the bother, but I get a little annoyed when people try to argue semantic difference in synonyms. What do you think is the difference between secure and safe?
Security and safety are not synonymous, they have a different meaning.
Security is that your password is stored in a way that it cannot be accessed by those you don’t want. Safety means that you won’t lose access to it and that it remains usable.
The distimction may be clearer with an other example.
A factory is secure if only the employees can enter, and it is safe if it does not want to fall apart and the machines in it don’t kill the employees.
Maybe it can be generalized so that security is for the access, safety is for the mistakes and the disasters.
No. Anyone near you or with access to your place can see it. And most people know of the tricks.
Also you can’t encrypt it and most of all you can’t really generate as strong passwords as those generated by password managers, meaning I don’t even need the paper to try and crack your password
My friend, you will be surprised that encryption is something that not only the magical internet machine can do.
It’s still nowhere near as secure and convenient as using an appropriate tool. You will either have one that is easy to decipher and remember or one that is hard to decipher and remember. And you have to do it every time but at that point you might aswell just remember one password/passphrase and use it for your password manager, defeating the whole point.
Also bare in mind convenience is important in security, if a measure is very inconvenient you will eventually just bypass it on your own cause you can’t be arsed.
Using 2FA on all accounts that offer it is just as important. And make sure to use a good, open-source TOTP client like Aegis on Android or Tofu on iOS.
Definitely make sure to backup your seeds in an encrypted format (e.g. Veracrypt container or GPG-encrypted files). If you lose your seeds, you lose access to your accounts.
I like to use the automatic backup feature in Aegis, which syncs my encrypted vault to my Nextcloud server. You can also enable compatibility with Android’s backup API and use that if your ROM includes a backup solution like Seedvault.
Any comments on bit Warden for totp?
TOTP is standardised by RFC 6238 so all TOTP clients must comply with the standard and therefore work equally well. Pick the one whose UI you like the most and is otherwise good enough for your use case and personal preferences. It’s similar to arguments over CPU thermal paste—its presence or absence makes a much larger difference than the method of application.
You do, however, want to pick something that is free and open-source and also popular. Google Authenticator (closed source) definitely is a functional TOTP client but you have to trust that the Google engineers have done a good job building a secure app. Since it’s Google, they probably have, but a principle in security is that you should not have to trust more people than absolutely necessary.
Personally I wouldn’t keep my TOTP together with my passwords, but it’s up to you
You can but shouldnt.
Ok would you tell more?
What’s frustrating is that most sites want your phone number. Even though it’s less secure than totp, but that sweet sweet data using your phone number as a common index is irresistible
It might not be any more private but I give out my Google voice number to people/businesses I don’t really want to hear from or suspect my data will be sold by.
What’s really frustrating is that some services detect GV (and other VOIP providers) and just say you can’t use it.
True. Even government websites refuse to verify you over a VoIP line.
Forgot to add this bit in my first reply:
This is especially bad since I’m more confident that GV is less susceptible to a SIM swap type of attack since I can disable it on my account which is of course protected by real 2FA (not SMS).
Meanwhile T-Mobile has shown a few times that they’re vulnerable to SIM swap attacks.
And best case on an actual separate device.
And if the company doesnt supply one, use your own at your own discretion /shrug
I don’t really think a separate device like a phone is necessary to store 2FA tokens, the only option I would consider is a hardware key like YubiKey for storing TOTPs.
Why preach to this choir? I get you, but we also get it.
My dad somehow believes that that password managers are very insecure ( he got that from some sort of ‘reputable source’, so me telling him bitwarden is secure doesn’t help) and he just writes down all of his completely randomly generated passwords in a notebook, which always seems really inefficient to me, especially when he writes a character down incorrectly.
I mean he’s not wrong about paper being more secure than password manager (provided you have good physical security and trust the people you live with)
Well yeah I guess that’s true
Yes, but this is like replacing the front door of your house with a bank vault door. Yes, it’s more secure, but there is a point of “reasonably secure enough” for most people and at some point, you are just inconveniencing yourself for no tangible gain.
Only until he gets a keylogger on his computer
He’s doing something right.
You can’t hack a paper note over the internet.
You can’t grep dead trees, password managers are only as secure as their infrastructure which are constantly being backdoored, socially engineered and poorly administered. Anyone that trusts a simple security solution is a fool.
It’s not a hard concept. In almost every well-designed security system, the weakest links are invariably the humans
At least reputable companies do 3rd party audits and I have yet to hear about bitwarden getting pwned.
One of the only possibilities is them and their infrastructure getting ransomed
Honestly this is the part that scares me the most. Well maybe it’s the fact we have multiple plausible scenarios… What happens when you get locked out of bitwarden? I imagine the 256 randomized salted hash passwords will be hard to call, some companies will likely be able to restore your password via phone support. During that time, informed attackers will potentially have the master keys to your entire life. Fighting ai chatbots trying to recall security questions. During that time your phone and Internet service could be shut off, secondary emails changed and validated, money transferred out of bank accounts, stocks and crypto sold. Crowdstrike was a valuable security company.
The FAQ answers the question of getting locked out: bitwarden.com/help/forgot-master-password/
TLDR: You are fucked if you lost the recovery codes.
Best case: You do encrypted backups every once in a while
Is your dad Ron Swanson? /j
I have relatives that do this, but they record it accurately and put it in a safe.
My wife does this with index cards. I have to try to figure out what she wrote down (1? l?) and she crosses out an old one and writes the new one in a random spot so I have to study the card to find the live pw.
Been using Bitwarden for a couple years now…
No regrets
I migrated to Bitwarden from Firefox a few months ago and I regret it as it’s slower and inconvenient while not adding any major features. So yes, use a password manager and the one provided by Firefox is perfect for almost everyone.
I agree, but I just know that someday Mozilla is going to go down and I’m gonna lose my passwords and I won’t even be able to get into my email to reset them.
The passwords are stored locally. You can test this yourself by turning off your WiFi or disconnecting your Ethernet cable and then going to about:logins. All the passwords will still be there.
You can also test it by logging in to a new computer and getting all your passwords there too
Please don’t confused this with backup as a sync could trigger a delete.
You can (and probably should) backup your passwords. Same goes for any hosted solution.
Quick question? Since Firefox is open source couldn’t you in theory modify where the password manager is going. Syncing your passwords from the browser to your local server. Idk, I just thought of that and know that that’ll never work or it may be too much work when there’s an alternative for that anyways. Just something I thought of from what you were saying about “if Mozilla may kill their servers” which they will imo.
There are several Firefox tools that do things like this if you look!
How is it more inconventient and slower?
The only reason should be that it needs to decrypt the vault upon login which (depending on the iterators of the encryption and the processing speed of the system) can take a second more. Until then it’s equal to a native integration.
Upside: You are not locked to a browser anymore as (at least Bitwarden) is agnostic.
On android, there’s a 4 second lag to get the fingerprint reader ready, 0 with Firefox.
I’m not going to switch from Firefox anytime soon but it’s super easy to export passwords and the Firefox password manager works for any apps on Android.
I also use Firefox on Android with a fairly recent stock ROM phone. At best the whole process to pasting my password into the webform takes 5 seconds.
If the vault is still within unlock period the auto-fill takes even less time (assuming the authentication URL regex is correct. It’s a bit annoying with subdomains)
How did you login to apps in your phone? Go to the computer and open Firefox? Bitwarden on the phone integrates into the apps directly.
Same as Firefox. You go to your Android settings and set Firefox as password manager. No need to go to the computer.
Ah interesting. I didn’t know that was possible!
They did a poor job advertising it…
I have the need to have different accounts to everything. Hate to perform the sign up process over and over again. They really need to standardize this.
Passkeys is one step forward but far from enough.
I hate the idea of having to login again and again with just a minute interval that I see BankID requires as it is for different things. Like I constantly have to prove it is still me here. BankID is the app in my country that gives you access to your Bank account, government stuff and so on. It connects to your personal number and ID you in real life.
So the issues you describe is just the result of how bad designed the web is today. It is simple for every company but hard for the user.
I am curious what country you’re from that they require a specific app for “official” business.
Sweden
They don’t require it, you can also go to a physical office if you don’t have BankID. Also BankID is a private company wo is problematic on several levels.
Many government agencies have started accepting multiple ways to identify yourself such as Freja.
Some politicians would prefer a standardized governmental solution to identity.https://dagensps.se/…/kinberg-batra-info…
I’m not so sure about that though.
It’s an ongoing topic. We’ll see more where it goes.
Sweden with BankID. The main app for it. Sometimes the goverment(not the banks) offers the alternative Freja E-ID frejaeid.com. The banks built BankID and charge companies that use it(not consumers).
I’m using Bitwarden, 1Password and KeePass. Works like a charme.
Why all three? Redundancy?
I started with Bitwarden as a replacement for KeePass and changed to 1Password due to the way they secure the login password (password + random string). KeePass is now my backup place for 1Password and I support Bitwarden with a subscription because I like to support their OSS way.
I used to use a plain text system, “encoded” in such a way that only I knew what the actual password was, and I kept it on Google Keep.
But that for harder and harder to manage, coupled with, if I were to get run over by a bus, no one else would be able to access my accounts.
Now I’ve been using Dashlane for a few years. Not just for passwords, but secure notes as well.
Works seamlessly on all of my devices and zero complaints.
I do exactly this (the google keep notes plain text encoded passwords idea), right now. Perhaps I’ll go the same route as you then… I was wondering what manager to use.
It is truly upsetting to see how complicated for use password managers are.
I grow up around computers and I can barely mange them. Other people just don’t understand how to use them, it is complicated and inconvenient. Even after I set them up and show them multiple times, friends don’t manage.
In browser password managers cover 90%, but I guess web sites and apps need to start testing UX for password managers. Some of them introduce stupid flows that brake all of them.
Android is complete shit show.
It is not users, but applications and UX that doesn’t care about security.
What’s wrong with android? I have bitwarden setup any basically any time I tap a password field it offers me to fill in from my vault.
Bitwarden on Android, particularly if you have biometric unlock enabled, is extremely simple to setup and use.
Sorta. I find it doesn’t always pop up Bitwarden to select an autofill. Then I unlock it manually, and sometimes it then gives me the button for autofill. Sometimes not and I have to manually copy and paste.
And sometimes there’s a broken ass app that blocks you pasting passwords. People need to be fired for this.
Same thing happened to me on Last Pass, so I’m pretty sure it’s an Android issue.
iCloud Keychain is super easy to use, but obviously you need a iOS/macOS to take advantage.
I use a password pattern. I have hundreds of different passwords all stored in my head and all between 10-20 characters long. The trick is to have a deterministic formula for picking a password.
Example: short word + First 6 in url + symbol + short word capitalised + number
Let’s say the first word is cat and second is dog, symbol is - and number is 5 and you have a Gmail it would give you
“catgmail-Dog5”
www.passwordmonster.com gives it 61 years to crack this one but if you use longer words you get better times.
Wait are you saying that with the example your provided your password for Lemmy would be catlemmy-Dog5? Because that’s a terrible system.
Maybe it’s not for you then. It’s been working pretty well for me and my passwords aren’t saved anywhere but locally in the browser.
It’s better than reusing the same password, but not by much. If one of your passwords get compromised, an attacker can easily guess to try to just replace “gmail” by whatever service they’re attempting to log into as you, and give it a shot.
That’s assuming that a human will ever see it. People cracking passwords either have all of them and then use an automated tool or hack a person specifically by decrypinc a password hash which will take an immense amount of time and electricity.
Still since that’s a concern I can modify the formula. By splitting gmail into g and mail and sticking g at the front.
gcatmail-Dog5
Not how it works.
First of all, there’s far too many companies out there still storing passwords in plaintext.
Second of all, even with a good hash algorithm, hacking a specific person’s password out of a leaked database is still feasible when your passwords are variants of a couple of dictionary words with a few numbers and symbols attached.
Creating fully randomized, unique passwords in a password manager really is the best way. Even an older hash method of storage on the web site’s part will likely protect it.
I think you might be preaching to the choir here.
Circlejerkin on lemmy is our mutual hobby here
I’ve been using Firefoxs integrated password manager for lots of unimportant logins, KeePass for everything else.
I clear everything on close
I tell non techy people to use a physical book that they can secure. People know how to do hide things or put them in a safe. Digital security is harder to understand and I would say a book in a safe place is way better than reusing passwords they find hard to remember.
I do that too.
I use Safe in Cloud but nobody ever talks about this one. Is it a bad one?
I’d be open to using a pw manager then I read the comments here and everyone is suggesting different apps, arguing over how inconvenient one or the other it, various issues, etc. It doesn’t make me feel like taking action if everything feels sketchy.
I just tried the free option (bitwarden) and then migrated to Proton to use all of their apps. TOTP support is also an added bonus for the Proton Pass since Authy has fucked off a cliff.
What happened with Authy? (As someone who uses it)
Couple of things happened, this and this. I got soured and needed to find a better alternatives for my TOTP.
I’m paying for Bitwarden’s Family plan and share it with three friends. It costs me ~80 cents per month and it just works. We are using it for multiple years now and migrated to their new EU servers this year. Bitwarden has everything I need and it’s in my opinion the best bang for your buck. But try out their free option and form your own opinion.
+1 for bitwarden
I actually combine a password manager with a password book, don’t like storing data for sensitive accounts on servers that can be breached and I’m too lazy to self host 😬 and I can remember my password phrases for sensitive accounts I use normally.