4 ms·
Ask HN: What is your preferred method of personal password storage?
Tell me you use a password manager.. if so which is your go-to and why? A proficient look at which is the best under the hood could be interesting in regards to user's security.
If you don't use a password manager.. it's 2016 how do you do it with presumably hundreds of online accounts, don't tell me you've got the same password..
- smt88 10y agoKeePass, secured with password + private key. The private key is not synced to the cloud, but the KeePass database is synced with SpiderOak. OwnCloud would be better for that, though. I will never touch anything like LastPass, Dashlane, etc., where you have no idea how secure anything is.
- dClauzel 10y agoMacOS’s keychain, and LastPass.
- sheraz 10y agoUp voted, and seconded. Last pass is great for group sharing as well.
- PaulHoule 10y agoI have a perl script that I type a pass phase into, as well as the domain name of site, and it uses a hash function to create a password. On average the password is rich in upper case, lower case, symbols, etc. Sometimes though it lacks a number or has a character that is not allowed, and the adaptations to that are another part of the story. I have thought of making a little JS app that runs on a web browser but haven't done it out of paranoia.
- edent 10y agoLastPass. It's good enough and worth the US$12/pa. Syncs with Linux & Android. Lets me easily share passwords where needed. Has 2FA. Literally renewed today. I did take a look at LessPass [sic] and a few others - I'd prefer an open-source and self hosted solution, but LastPass is cheap enough and convenient not to make it a priority. That said, I do have a few sites which I use my own self generated password - makes logging in on, say, smart TVs a bit easier. I use the same "algorithm" for each - for example, for Twitter, TWpass321. The other line of defence is a unique email address for each service. Using a catch-all email means I can be twit@example.com, bing@example.com, etc. If one if those services are compromised, I know exactly who has leaked my details - and they can't use those credentials to log into another service.