4 ms·

Is there an industry favorite password manager these days? Every time I read something like this I re-commit to getting a manager, but then I can never decide o

Is there an industry favorite password manager these days? Every time I read something like this I re-commit to getting a manager, but then I can never decide on a product. I just want something that's secure and preferably non subscription-based.

codegeek 10y ago
I like keepassx. It just works and no need for any online account. You use a good master key/password and rest of the passwords, don't even remember.
- el_benhameen 10y ago
  How do you personally handle passwords on multiple devices? Just host it somewhere publicly accessible and use a really strong master?
  - dannysu 10y ago
    I use Tresorit (https://tresorit.com https://tresorit.com) to sync across machines and phones.
  - Ajedi32 10y ago
    My setup is to store the database itself in a cloud storage service that supports 2FA like Dropbox, and encrypt it with a file/password combo key. The key file I manually copy to every device I use, and the master password is stored in my head. This way it's safe to store the database in the cloud without having to worry about attackers trying to brute force my master password if Dropbox gets compromised (since they'd also need the key file, which is only stored locally), and even if the key file is stolen the attacker would still need my master password to access the database.
- defined 10y ago
  +1 for keepassx. I use it on all platforms (well, keepass droid too). All passwords are randomly generated except the one for the keepassx db (and that also needs the key file).
- ce4 10y ago
  And keepass has also (some sort of) 2FA via a local key file. While it's of course not as good as a real token generator, it helps against password sniffing and makes cracking much harder.
mcpherrinm 10y ago
At least in the security circles I'm in, 1Password is the favorite. KeePassX is recommended sometimes too, but is definitely for the more technically-minded. There's a low level of distrust for Lastpass.
- MatthewWilkes 10y ago
  I'd love to use 1password still, but they have no Linux client (even cli), the web client is long gone, and the Android app is awful. It's really great software, but I don't feel valued as a customer at all.
  - passivepinetree 10y ago
    Did they really get rid of the web client? Last I checked they were moving toward the subscription base model and I thought that was more web-centric than the buy-once-and-forget-it version that I'm using.
  - theDoug 10y ago
    Web client absolutely exists for subscribers to their syncing service.
    - MatthewWilkes 10y ago
      Really? That's great news, I only found information about the ancient one that was special-cased in dropbox. I can't even see mention of it on the 1Password website, but as there's a free trial it seems low risk.
- tokenizerrr 10y ago
  What about KeePass2?
  - avhon1 10y ago
    KeePass is an open-source password manager. There are many compatible programs, many with confusingly-similar names, like KeePassX. KeePass2 is the new version of KeePass, which uses a new file format. Most KeePass-compatible programs, including KeePassX, support the old file format and the new one.
tptacek 10y ago
Just a data point: 1Password, in the standalone native app version, is the only password manager I recommend.
- el_benhameen 10y ago
  The other popular one here seems to be keepass. Do you have technical concerns with it, or is it just too user-unfriendly compared to 1Password?
  - wglb 10y ago
    See http://www.infosecisland.com/blogview/21776-KeePass-Vulnerability-Exposes-Password-Lists.html http://www.infosecisland.com/blogview/21776-KeePass-Vulnerab... and https://www.engadget.com/2016/06/04/keepass-wont-fix-security-hole-due-to-ads/ https://www.engadget.com/2016/06/04/keepass-wont-fix-securit...
leipert 10y ago
I migrated from lastpass to https://www.enpass.io/ https://www.enpass.io/ It is a cross platform PW manager with Browser extensions (i only use it on macOS with FF and Chromium, though), which does NOT store your passwords in the cloud. You can sync the database via Cloud storage providers/webdav/usb stick. I really like to be in control of where my passwords are stored. Sharing of passwords (business usecases!?) is not supported afaik.
Gaelan 10y ago
I use iCloud Keychain. Works well as long as you use safari, which is admittedly uncommon.
- el_benhameen 10y ago
  Yeah, I tried really hard to make Safari my default browser in order to use keychain. Keychain itself was great, but safari just didn't cut it for me. Their devtools equivalent is terrible, and I didn't like running two browsers. I was bummed to lose keychain, though.
  - Gaelan 10y ago
    Huh, I find safari's devtools much more useful than Chrome's, though I admit I am more used to it. What annoys you about Safari's dev tools?

codegeek 10y ago

I like keepassx. It just works and no need for any online account. You use a good master key/password and rest of the passwords, don't even remember.

el_benhameen 10y ago
How do you personally handle passwords on multiple devices? Just host it somewhere publicly accessible and use a really strong master?
- dannysu 10y ago
  I use Tresorit (https://tresorit.com https://tresorit.com) to sync across machines and phones.
- Ajedi32 10y ago
  My setup is to store the database itself in a cloud storage service that supports 2FA like Dropbox, and encrypt it with a file/password combo key. The key file I manually copy to every device I use, and the master password is stored in my head. This way it's safe to store the database in the cloud without having to worry about attackers trying to brute force my master password if Dropbox gets compromised (since they'd also need the key file, which is only stored locally), and even if the key file is stolen the attacker would still need my master password to access the database.
defined 10y ago
+1 for keepassx. I use it on all platforms (well, keepass droid too). All passwords are randomly generated except the one for the keepassx db (and that also needs the key file).
ce4 10y ago
And keepass has also (some sort of) 2FA via a local key file. While it's of course not as good as a real token generator, it helps against password sniffing and makes cracking much harder.

mcpherrinm 10y ago

At least in the security circles I'm in, 1Password is the favorite. KeePassX is recommended sometimes too, but is definitely for the more technically-minded. There's a low level of distrust for Lastpass.

MatthewWilkes 10y ago
I'd love to use 1password still, but they have no Linux client (even cli), the web client is long gone, and the Android app is awful. It's really great software, but I don't feel valued as a customer at all.
- passivepinetree 10y ago
  Did they really get rid of the web client? Last I checked they were moving toward the subscription base model and I thought that was more web-centric than the buy-once-and-forget-it version that I'm using.
- theDoug 10y ago
  Web client absolutely exists for subscribers to their syncing service.
  - MatthewWilkes 10y ago
    Really? That's great news, I only found information about the ancient one that was special-cased in dropbox. I can't even see mention of it on the 1Password website, but as there's a free trial it seems low risk.
tokenizerrr 10y ago
What about KeePass2?
- avhon1 10y ago
  KeePass is an open-source password manager. There are many compatible programs, many with confusingly-similar names, like KeePassX. KeePass2 is the new version of KeePass, which uses a new file format. Most KeePass-compatible programs, including KeePassX, support the old file format and the new one.

tptacek 10y ago

Just a data point: 1Password, in the standalone native app version, is the only password manager I recommend.

el_benhameen 10y ago
The other popular one here seems to be keepass. Do you have technical concerns with it, or is it just too user-unfriendly compared to 1Password?
- wglb 10y ago
  See http://www.infosecisland.com/blogview/21776-KeePass-Vulnerability-Exposes-Password-Lists.html http://www.infosecisland.com/blogview/21776-KeePass-Vulnerab... and https://www.engadget.com/2016/06/04/keepass-wont-fix-security-hole-due-to-ads/ https://www.engadget.com/2016/06/04/keepass-wont-fix-securit...

leipert 10y ago

I migrated from lastpass to https://www.enpass.io/ https://www.enpass.io/ It is a cross platform PW manager with Browser extensions (i only use it on macOS with FF and Chromium, though), which does NOT store your passwords in the cloud. You can sync the database via Cloud storage providers/webdav/usb stick. I really like to be in control of where my passwords are stored. Sharing of passwords (business usecases!?) is not supported afaik.

Gaelan 10y ago

I use iCloud Keychain. Works well as long as you use safari, which is admittedly uncommon.

el_benhameen 10y ago
Yeah, I tried really hard to make Safari my default browser in order to use keychain. Keychain itself was great, but safari just didn't cut it for me. Their devtools equivalent is terrible, and I didn't like running two browsers. I was bummed to lose keychain, though.
- Gaelan 10y ago
  Huh, I find safari's devtools much more useful than Chrome's, though I admit I am more used to it. What annoys you about Safari's dev tools?