8 ms·

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found

• sebazzz 9y ago
  Keepass works great, but one disadvantage is that you cannot you additional credentials providers if you want to open your database on other devices. For instance, if I would use a Yubikey provider, I cannot open the database on my iPhone. It would be great if the authentication providers can be configured in an 'or' instead of an 'AND' (this means convenience vs security). So on Windows, with my Windows account or perhaps Hello it unlocks my Keepass database and perhaps use a Yubikey, but on my iPhone I'm still required to enter a password. But unfortunately, the current implementation combines the authentication providers to create a combined encryption key. But still, Keepass is easy to setup and maintain. Just put your database on your favorite cloud provider (if you want to take the risk) or manually sync it to your phone and you got the righty credentials everywhere at hand.
  • Spooky23 9y ago
    One way to address this is to have a long term vault that doesn’t get edited often and a working vault.
• whitepoplar 9y ago
  1Password is fantastic.
  • deleted 9y ago
    [deleted]
• bllguo 9y ago
  I've used Lastpass for awhile, and so does my work. Recently I switched to Bitwarden partly because of security concerns, partly because it's open source, but mostly due to Firefox moving to WebExtensions. They both have free options!
  • BugsJustFindMe 9y ago
    How recently? Because https://addons.mozilla.org/en-US/firefox/addon/lastpass-password-manager/versions/ https://addons.mozilla.org/en-US/firefox/addon/lastpass-pass... shows "Compatible with Firefox 57+" since early November.
    • bllguo 9y ago
      There was no compatibility when I switched, and I waited for some time (I use Nightly). Maybe "recent" is misleading.
• m_st 9y ago
  Have a look at 1password.com and their family plan, so you can admin your parents too, in case they forget their master password. Can’t recommend this enough. Edit: If that helps, Troy Hunt and other security guys are also using 1password (even the cloud solution).
• sachleen 9y ago
  Long time lastpass user recently switched to BitWarden. I find it's UI to be cleaner/easier to use
  • ibdf 9y ago
    My biggest frustration with lastpass is that it doesn't seem to know the difference between subdomains, so it suggests several passwords for the same domain even though I am on different subdomains.
    • y4mi 9y ago
      There was an option somewhere with which you could disable that one url at a time. I never bothered with it though and recently switched to keepass, so can't verify anymore.
  • xeonoex 9y ago
    How is BitWardens UX on mobile? Does it support autofill and automatically adding/updating passwords you enter on apps or the browser?
• JoshTriplett 9y ago
  The Firefox password manager, combined with Firefox Sync, works across Windows, Mac, Linux, iOS, and Android.
  • 667 9y ago
    Been using this a few years, it's really good from user standpoint.
• ythn 9y ago
  Algorithmic password in your head, with a google spreadsheet to keep track of usernames, password rules, etc. on a per site basis (i.e. "bankofamerica, ythn.smith@gmail.com, 4-12 characters - no special). Edit: downvote away, but so far no one has ever been able to give a compelling reason why algorithmic passwords are bad. It has tradeoffs, sure, but so do password managers.
  • pbhjpbhj 9y ago
    If a couple of your algorithmic passwords get leaked, attached to same email, then the algo could be guessed and you potentially lost all your accounts.
    • ythn 9y ago
      That's a lot of unlikely ifs. And that also assumes my algo is easy to reverse from 2 digests. My counter to that is that it is unlikely anyone would specifically target me and waste resources trying to crack my algorithm when there is so much low hanging fruit elsewhere. If I am specifically being targeted, I've probably already lost, even if I use a PW manager. Compare to PW managers: "If your password db and master password get leaked, attached to the same email, then you lost all your accounts." Also with PW manager, losing your phone can mean Denial-of-Service to all of your accounts if you are i.e. travelling.
      • pbhjpbhj 9y ago
        Other methods being poorer doesn't make your method objectively better. You're probably right on low-hanging fruit, all depends on your threat model I suppose. Don't password managers have 2FA, and alternate phone numbers?
        • ythn 9y ago
          There is no method that is objectively best. Every single current method has tradeoffs. Being cumbersome to setup/use/recover is a big tradeoff of PW Managers.
• baxtr 9y ago
  Actually, I’m pretty happy with the integrated iOS password manager. They also feature app support now. Works like a charm for me
  • ovao 9y ago
    Happily, too, Safari’s suggested passwords have pretty good entropy and are sensible enough to be accepted by many password rulesets.
• fiatjaf 9y ago
  I don't trust myself enough to keep track of a local database of passwords, because of that for years I sticked to the tactic of repeating the same 2~3 passwords over and over on all websites. Now I'm using https://lesspass.com/ https://lesspass.com/, a deterministic password generator that requires no setup besides installing a browser extension[1] and doesn't requires me to keep a database or run any other custom programs. [1]: There's the official extension for all browsers, but I've developed my own, https://lesspass.alhur.es/ https://lesspass.alhur.es/, which solves 99% of the problems associated with the whole LessPass idea.
  • ythn 9y ago
    How does lesspass handle password rules? i.e. one site allows special characters, others don't? Or say one of your passwords gets compromised and you need to change it. It doesn't seem like lesspass would be able to do so without a db.
    • stordoff 9y ago
      I've been trialing it recently on sites of lesser importance, and in the configuration OP described, it doesn't - everything is deterministic from login+site+master password. It does however you set password profiles, which alter how the password is generated. Here's an abridged example from their FAQ[0] with my notes about what each option does: "login": "contact@lesspass.com", # User name "site": "example.org", # Domain name "lowercase": false, # Site accepts lower case characters (Default: true) "uppercase": false, # Site accepts upper case characters (Default: true) "symbols": false, # Site accepts symbols (Default: true) "numbers": true, # Site accepts numbers (Default: true) "counter": 1, # Increment e.g. on compromise and the generated password is changed (Default: 1) # Password entropy is derived from pbkdf2, counter is used as part of the salt "length": 8, # Password length to be generated (Default: 16) In the default configuration, these profiles are stored in the browser's local storage, so lost if/when that is cleared. LessPass provide a service to store these profiles on their server (log-in is generated from the master password using a default password profile), and provide the scripts (Docker) that let you self-host this data (the browser extensions include a field to set server domain). For me, it's a useful balance of convenience and security (each site gets a strong unique password, but I can regenerated them on devices where I haven't synced a password DB) vs. KeyPass which I was previously using. I'm probably going to switch to 1Password thought - it gives the same "any device" benefits, has basically the same risk model (compromise of the master password is a full-compromise, and because I need the synced profiles I need to put _some_ trust in a third-party anyway[1]), but it gives me the full flexibility of a real password manager (store associated data, credit cards, set specific passwords if needed etc.) [0] https://github.com/lesspass/lesspass/wiki/FAQ https://github.com/lesspass/lesspass/wiki/FAQ [1] 1Password: need to trust their client isn't malicious/capturing the password at login and is secure; LessPass: need to trust the webclient is never changed to exfil. the master password, (theoretical?) risk of brute-forcing master password from a generated password, and sends sites/username metadata to a largely unknown third party (could run my own server, but it would likely get neglected and fall behind on security updates etc.).
• y03a 9y ago
  Just keep in mind anything simpler likely has additional attack surfaces. e.g. Anything that's cloud based, browser plug-in, centralized, etc. all bring the standard attack surfaces in that domain. Still, it's probably better than what most people do, same user name/password combo everywhere.
• chrislomax 9y ago
  Again, 1Password. It allows you to login to multiple workspaces so you can have your family plan and your work team plan at the same time. There is a cost but I can guarantee that it’s saved me more in time than the cost could ever amount to. I’ve never used an insecure password since using it. All completely random and it’s so easy to use. The different vaults means I can grant my little boy access to the stuff he uses whilst having my credit card and server details in other vaults without fear that he can access them (more the credit card details). I just need to get the wife into using it now...
  • __jal 9y ago
    I love 1Password and have used it for years. But be aware that they are moving to cloud storage for password data. At this point, you're not forced in to it (and they've made no concrete announcement yet), but that's pretty clearly where they want to go. Perhaps that's acceptable to you; I'll be moving off at that point. But in any case, it is something to be aware of when choosing something like this - moving between password managers is a hassle.
    • angerbot 9y ago
      Have you read their security white paper[1]? As much as I tend to freak out about cloud storage of password data (one reason I moved off of lastpass), they do seem to take fairly strong steps to host-proof the data (such as having an on-device generated secret key that they never receive). [1]: https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf https://1password.com/files/1Password%20for%20Teams%20White%...
      • __jal 9y ago
        I did read it. For me, it doesn't matter for two reasons. Professionally, I have a policy to comply with. And personally, I don't use other peoples' machines for personal storage, period. So why would I want my (even well protected, assuming 1PW didn't make a mistake) passwords to be an exception?
      • Spooky23 9y ago
• funkymike 9y ago
  I've tried to get my mom to use KeePass with limited success. To her having her easily guessable passwords written in a little notebook next to the computer is fine. I think a prerequisite is getting buy in on the idea that passwords need to be treated like the keys to your house or your bank account numbers.
  • p1necone 9y ago
    As far as I'm concerned writing passwords in a notebook in a draw or something is fine. The easily guessable part not so much. If someone has physical access to your computer in the first place there's lots of things they could do.
• SteveJS 9y ago
  I was looking at Dashlane which seemed to have some good features, including some ability to do password rotation automatically, and some level of yubikey support. That said I'm still using keepass. I discovered it when I needed a solution that worked on an original Surface RT, as well as an iphone, and I've remained happy.
  • PuffinBlue 9y ago
    Now Dashlane seems to have in browser apps and finally supports Linux, I'm looking at moving away from Lastpass. Between them and BitWarden there seems to be quite good options form Linux users now. If anyone is a DashLane/BitWarden user and wants to chime in with their experience them that would be much appreciated.
    • doublerebel 9y ago
      I love Dashlane, and the Linux support is solid through the browser extension. Dashlane has the best interface across devices, of all the password managers I've used. The password sharing feature is great for business. Sure, it's a cloud service, but it's polished enough that I can get non-tech people like my family and coworkers to actually use it. Lastpass did not pass that test. I use Dashlane every day on Mac, Linux, Windows, and Android.
      • PuffinBlue 9y ago
        Thanks. One question I have - can you turn off auto-login globally or just on a per website basis? Docs seem to imply on a per site basis only but that seems a bit odd. I'm wondering how DashLane handles multiple logins for the same service (Google/GitHub etc etc).
        • doublerebel 9y ago
          I'm not sure about the global option, I've never tried. For multiple logins on the same service/domain, it presents a clickable/tappable list.
• qznc 9y ago
  I'm a heavy KeePass user in private and I like it. Recently, I was pleasently surprised that my new corporate IT overlords allow me to use it at work too. Password generation is fine. Whenever you create a new entry it prepopulates it with a generated password. Just type in domain and username and hit ok. On the negative side, KeePass UI is old school. Lots of buttons and options. Not streamlined for the common use cases. (No comment on download and setup, since I'm not a Windows user)