4 ms·

Slightly OT but anyone has a REALLY easy password manager solution? I tried migrating my entire family to a 1Password family account. Honestly for people with

Slightly OT but anyone has a REALLY easy password manager solution? I tried migrating my entire family to a 1Password family account. Honestly for people with limited tech-knowledge even 1PW is still too complicated. - In 25% of the cases it does not save e.g. the username correct. Explaining my parents how to open the app, edit the login, etc. is just not gonna work. - they don't prefill logins (like e.g. Dashlane) so you either have to press the icon or do the keyboard shortcut. Again not suitable for someone who is not very technical. - On some sites (even big ones) the user/password inserting simply does not work. Explaining them how to open the app, copy user/pass, switch to browser... not gonna work. - generating random passwords and filling them on registration page does not work 100% either - using it on mobile is just horrible. Only thing I could come up with would be (on a Mac) the built in password „manager“. Any ideas? Hate people using their birthday as pw just because there is no easy solution to this problem.

mbesto 9y ago
I've heard Dashlane is more "grandma" friendly (albeit at the cost of some security).
- jondwillis 9y ago
  As a dashlane user, these UX problems still apply.
grinsekatze 9y ago
I tried to convince my father to use a password manager and tried to explain that using the same 8 letter password for 75% of services is incredibly risky, but i got so much resistance from him .. in the end he wanted me to send him an article on why a password manager would be good. When I looked for something I could send him and thought about what I need to do to help him transition to using a password manager I realized that even though there are great services out there are I don’t want to be responsible for messing with his current way of doing stuff. So I let it go. I use keepassXC (actually MacPass, which is brilliant and has an HTTPConnecter plugin that can talk to the Firefox addon keepasshttp) and it works great. Maybe not as fancy as 1P etc but free and open source. On iOS I use MiniKeePass which also works well. This is the setup that I was going to suggest to him. Personally I find it not that complicated, just needs some time to get used to the routines.
- PuffinBlue 9y ago
  Just make sure that the MacPass implementation of that HTTPconnector isn't listening on 0.0.0.0 by default. Some implementations do and it has been patched in the main repo but didn't make it out to all users. Communication from KeePass/MacPass to the browser is just over http as the name suggests so passwords are sent in plain text and can be sniffed over the network. If it's confined to localhost then you're fine as it's as secure as not having a compromised device in the first place.
notheguyouthink 9y ago
> In 25% of the cases it does not save e.g. the username correct. Explaining my parents how to open the app, edit the login, etc. is just not gonna work. Can you explain this issue a bit more? I use 1password, and I would be very angry if it randomly did not record my input data correctly. Yet, it's been flawless. Whether it's a username, a custom data field, an email, a site, a custom password, etc - it has never not recorded a piece of data I gave it. I'm on OSX, Windows and iPhone. Is there an issue here I should be aware of? Because not recording data is a big, big deal..
- jsjohnst 9y ago
  This usually happens to me when I do a reset password flow for a login that was previously not in 1Password. 1Password then saves the password, but not the login. It also happens sometimes when the password entry is on a different page from the login entry field. A third scenario that sometimes occurs is when a website mangled what was put into the login form before field submit (this usually only happens with ISP provided routers, but have seen other cases).
  - eridius 9y ago
    I just discovered today, looking through 1Password's "weak passwords" section, that 7 years ago I recorded a password for one "Optumhealthbank", and the recorded password was **** My best guess is they used JavaScript to replace the contents of the text field before submission. Thankfully I've apparently never needed to use this password. That said, out of 1000+ saved passwords, this is the only case like that I've seen.
    - jsjohnst 9y ago
      Yeah, I think I could count the number of times that one has happened on one hand in the past decade, but it definitely has happened enough I remember it.
- always_good 9y ago
  When you fill in a username/password combo and it pops up offering to save it as a login for you, it just doesn't know that there's a username field. When you revisit that entry in the future. Like possibly the far future when your one-year-long session finally expires, you'll find out you only have a password. Pretty bad UX. The popup that has [Cancel] [Save] should just show you the username and blotted out password for you to confirm. I have a few entries where I was so paranoid that I said fuck it and copied my password right into the name of the website entry. So I'm wondering if there's a case where it only saves the username and not the password because it doesn't detect it? I just haven't registered for a website in a long time so I only remember the one case. If you haven't encountered it, you're just lucky or, more likely, haven't yet noticed. ;)
chadlavi 9y ago
My MIL literally has a notebook in her house where she writes down her passwords. I scoffed when I found out about this, but then considered, well, it's a lot more secure than what she was doing before she had it, and the chances of someone breaking into her physical house for it are pretty slim. Maybe suggest that to them? I mean, I dunno. Knowing how to press an icon or copy-paste content from one app to another is sort of computer table stakes in 2018. These are problems on the user end, not the product end. It would be terribly insecure if their passwords were just automatically input every time someone on their computer opened a login screen.
- rovek 9y ago
  > ...the chances of someone breaking into her physical house for it are pretty slim I find this to be quite an under-represented opinion whenever I encounter password security discussions. How many people's threat models need consider physical security of their house? Surely most people's number one - if not only - threat is using a compromised service, so a password manager is just another vector; albeit one whose raison d'etre is security.
  - always_good 9y ago
    Also, petty thieves just don't care about your book of passwords. Just like they don't care about seeing if your hard drive is unencrypted when they steal your laptop - they just pawn it off. Of course, the ideal for security is that the best options are so convenient that you might as well do them. But there sure is a lot of circlejerking that happens when someone is exposed as "doing it wrong."
  - PuffinBlue 9y ago
    I fully agree with you and it's nice to see that someone else is thinking pragmatically and not ending up arguing over three letter agencies. If your machine with the password manager gets pwned then it's probably game over, and you can do that remotely for a networked device. So at the very least it's reasonable to compare the physical security of a paper notebook and a computer. Yes you might have encrypted the device but as everyone is so fond of saying 'once you have physical access it's game over anyway', so by that logic the notebook and computer are as secure as one another as they both rely on physical security. Maybe the computer is even less secure as you can attack it over the network! It's important to plan for disaster recovery though. That's probably a more reasonable fear - something like fire or accidentally spilling coffee over the book would be pretty bad. Maybe a backup copy in a waterproof fire safe would be a 'good enough' solution for priority accounts like email from where you can probably reset/recover all other accounts.
awinder 9y ago
I’m not sure about family friendliness but I’ve basically moved to letting 1password and the iOS password manager coexist. iOS manager is basically fulfilling the role of cache + autofill from keyboard.
wmeredith 9y ago
The most layman friendly thing I've come up with for parents/wife/kids/etc... is Safari on a Mac + iPhone using Apple's built in keychain manager. That's an insanely expensive solution compared to password management software though.
always_good 9y ago
I think 1Password's issues are a UI issue. I've been using it for years and I still sometimes can't find the "Edit" button when the app is full-screened because it's so far away at the bottom. Also, the 25% failure you speak of is why I don't trust it at all. All it takes is one time where it doesn't save your username and it becomes useless. So I just open it up and create entries manually. Which is fine for me but exactly something I wouldn't expect everyone to do since the app trains you to depend on its autosave. I think a few UI changes would go a long way. I have a mental list and wish it would be worthwhile to build my own, as every developer likes to think. But in reality it just feels like a list of minor features/tweaks they can add eventually.
twblalock 9y ago
Every password manager has broken/buggy autofill on at least some sites. It's a really hard thing to get right, and the developers are always one step behind the changes that are made to the sites.

mbesto 9y ago

I've heard Dashlane is more "grandma" friendly (albeit at the cost of some security).

jondwillis 9y ago
As a dashlane user, these UX problems still apply.

grinsekatze 9y ago

I tried to convince my father to use a password manager and tried to explain that using the same 8 letter password for 75% of services is incredibly risky, but i got so much resistance from him .. in the end he wanted me to send him an article on why a password manager would be good. When I looked for something I could send him and thought about what I need to do to help him transition to using a password manager I realized that even though there are great services out there are I don’t want to be responsible for messing with his current way of doing stuff. So I let it go. I use keepassXC (actually MacPass, which is brilliant and has an HTTPConnecter plugin that can talk to the Firefox addon keepasshttp) and it works great. Maybe not as fancy as 1P etc but free and open source. On iOS I use MiniKeePass which also works well. This is the setup that I was going to suggest to him. Personally I find it not that complicated, just needs some time to get used to the routines.

PuffinBlue 9y ago
Just make sure that the MacPass implementation of that HTTPconnector isn't listening on 0.0.0.0 by default. Some implementations do and it has been patched in the main repo but didn't make it out to all users. Communication from KeePass/MacPass to the browser is just over http as the name suggests so passwords are sent in plain text and can be sniffed over the network. If it's confined to localhost then you're fine as it's as secure as not having a compromised device in the first place.

notheguyouthink 9y ago

> In 25% of the cases it does not save e.g. the username correct. Explaining my parents how to open the app, edit the login, etc. is just not gonna work. Can you explain this issue a bit more? I use 1password, and I would be very angry if it randomly did not record my input data correctly. Yet, it's been flawless. Whether it's a username, a custom data field, an email, a site, a custom password, etc - it has never not recorded a piece of data I gave it. I'm on OSX, Windows and iPhone. Is there an issue here I should be aware of? Because not recording data is a big, big deal..

jsjohnst 9y ago
This usually happens to me when I do a reset password flow for a login that was previously not in 1Password. 1Password then saves the password, but not the login. It also happens sometimes when the password entry is on a different page from the login entry field. A third scenario that sometimes occurs is when a website mangled what was put into the login form before field submit (this usually only happens with ISP provided routers, but have seen other cases).
- eridius 9y ago
  I just discovered today, looking through 1Password's "weak passwords" section, that 7 years ago I recorded a password for one "Optumhealthbank", and the recorded password was **** My best guess is they used JavaScript to replace the contents of the text field before submission. Thankfully I've apparently never needed to use this password. That said, out of 1000+ saved passwords, this is the only case like that I've seen.
  - jsjohnst 9y ago
    Yeah, I think I could count the number of times that one has happened on one hand in the past decade, but it definitely has happened enough I remember it.
always_good 9y ago
When you fill in a username/password combo and it pops up offering to save it as a login for you, it just doesn't know that there's a username field. When you revisit that entry in the future. Like possibly the far future when your one-year-long session finally expires, you'll find out you only have a password. Pretty bad UX. The popup that has [Cancel] [Save] should just show you the username and blotted out password for you to confirm. I have a few entries where I was so paranoid that I said fuck it and copied my password right into the name of the website entry. So I'm wondering if there's a case where it only saves the username and not the password because it doesn't detect it? I just haven't registered for a website in a long time so I only remember the one case. If you haven't encountered it, you're just lucky or, more likely, haven't yet noticed. ;)

chadlavi 9y ago

My MIL literally has a notebook in her house where she writes down her passwords. I scoffed when I found out about this, but then considered, well, it's a lot more secure than what she was doing before she had it, and the chances of someone breaking into her physical house for it are pretty slim. Maybe suggest that to them? I mean, I dunno. Knowing how to press an icon or copy-paste content from one app to another is sort of computer table stakes in 2018. These are problems on the user end, not the product end. It would be terribly insecure if their passwords were just automatically input every time someone on their computer opened a login screen.

rovek 9y ago
> ...the chances of someone breaking into her physical house for it are pretty slim I find this to be quite an under-represented opinion whenever I encounter password security discussions. How many people's threat models need consider physical security of their house? Surely most people's number one - if not only - threat is using a compromised service, so a password manager is just another vector; albeit one whose raison d'etre is security.
- always_good 9y ago
  Also, petty thieves just don't care about your book of passwords. Just like they don't care about seeing if your hard drive is unencrypted when they steal your laptop - they just pawn it off. Of course, the ideal for security is that the best options are so convenient that you might as well do them. But there sure is a lot of circlejerking that happens when someone is exposed as "doing it wrong."
- PuffinBlue 9y ago
  I fully agree with you and it's nice to see that someone else is thinking pragmatically and not ending up arguing over three letter agencies. If your machine with the password manager gets pwned then it's probably game over, and you can do that remotely for a networked device. So at the very least it's reasonable to compare the physical security of a paper notebook and a computer. Yes you might have encrypted the device but as everyone is so fond of saying 'once you have physical access it's game over anyway', so by that logic the notebook and computer are as secure as one another as they both rely on physical security. Maybe the computer is even less secure as you can attack it over the network! It's important to plan for disaster recovery though. That's probably a more reasonable fear - something like fire or accidentally spilling coffee over the book would be pretty bad. Maybe a backup copy in a waterproof fire safe would be a 'good enough' solution for priority accounts like email from where you can probably reset/recover all other accounts.

awinder 9y ago

I’m not sure about family friendliness but I’ve basically moved to letting 1password and the iOS password manager coexist. iOS manager is basically fulfilling the role of cache + autofill from keyboard.

wmeredith 9y ago

The most layman friendly thing I've come up with for parents/wife/kids/etc... is Safari on a Mac + iPhone using Apple's built in keychain manager. That's an insanely expensive solution compared to password management software though.

always_good 9y ago

I think 1Password's issues are a UI issue. I've been using it for years and I still sometimes can't find the "Edit" button when the app is full-screened because it's so far away at the bottom. Also, the 25% failure you speak of is why I don't trust it at all. All it takes is one time where it doesn't save your username and it becomes useless. So I just open it up and create entries manually. Which is fine for me but exactly something I wouldn't expect everyone to do since the app trains you to depend on its autosave. I think a few UI changes would go a long way. I have a mental list and wish it would be worthwhile to build my own, as every developer likes to think. But in reality it just feels like a list of minor features/tweaks they can add eventually.

twblalock 9y ago

Every password manager has broken/buggy autofill on at least some sites. It's a really hard thing to get right, and the developers are always one step behind the changes that are made to the sites.