4 ms·

> Using a password manager means you either only use a single device for all your internet, or you deal with the synchronisation problem yourself. Is synchroni

> Using a password manager means you either only use a single device for all your internet, or you deal with the synchronisation problem yourself. Is synchronisation a problem? 1Password does it all for me, I don't even notice it.

nickjj 5y ago
> Is synchronisation a problem? 1Password does it all for me, I don't even notice it. It is for me. I use a command line password manager using the `pass` tool. I choose not to use any browser extensions or sync these passwords in a way where they leave my main workstation. It's really inconvenient when I need to use my phone to login to some site. It involves manually typing in some password that looks like this: aC6)&hahi*`9$Ik+WU7xA[igDfw\w'"VC_^VKh{<|PU~EQb{. You have any idea how tedious that is to do on a phone, especially when the site doesn't offer a way to see the password with a toggle? :D, on my workstation my password manager copies it to my clipboard for a short period of time so there's no typing involved. Magic links solve this problem because all I have to do is be logged into my email account to be able to access any site that uses magic links.
- beecafe 5y ago
  So you don't want to sync passwords to your phone, but are happy syncing email, which would allow a far greater compromise (beyond just being able to magic link or password reset you)?
  - nickjj 5y ago
    I'm not sure how that falls inline with passwords vs magic links? Personally I have my email password remembered, I don't sync anything between my workstation and phone such as browser accounts or anything like that. All I know is, logging into a site using a magic link on a phone for me is much easier since all I have to do is check my email and click a link instead of typing a ~50 character randomly generated password that I made on my workstation when using the site originally. If someone already has access to my email then it's game over.
    - Tagbert 5y ago
      It’s great if that is an option for you, but for many of us, if a site requires email logins, it is a fail. Much of the time, by the time the authentication email arrives, the login timeout has expired.
      - nickjj 5y ago
        If a site makes it time out after 5-10 minutes that's on them. An hour should be ample time for it to be delivered while offering a decent amount of security around token availability, especially since it should be revoked as soon as it's been used once.

nickjj 5y ago

> Is synchronisation a problem? 1Password does it all for me, I don't even notice it. It is for me. I use a command line password manager using the `pass` tool. I choose not to use any browser extensions or sync these passwords in a way where they leave my main workstation. It's really inconvenient when I need to use my phone to login to some site. It involves manually typing in some password that looks like this: aC6)&hahi*`9$Ik+WU7xA[igDfw\w'"VC_^VKh{<|PU~EQb{. You have any idea how tedious that is to do on a phone, especially when the site doesn't offer a way to see the password with a toggle? :D, on my workstation my password manager copies it to my clipboard for a short period of time so there's no typing involved. Magic links solve this problem because all I have to do is be logged into my email account to be able to access any site that uses magic links.

beecafe 5y ago
So you don't want to sync passwords to your phone, but are happy syncing email, which would allow a far greater compromise (beyond just being able to magic link or password reset you)?
- nickjj 5y ago
  I'm not sure how that falls inline with passwords vs magic links? Personally I have my email password remembered, I don't sync anything between my workstation and phone such as browser accounts or anything like that. All I know is, logging into a site using a magic link on a phone for me is much easier since all I have to do is check my email and click a link instead of typing a ~50 character randomly generated password that I made on my workstation when using the site originally. If someone already has access to my email then it's game over.
  - Tagbert 5y ago
    It’s great if that is an option for you, but for many of us, if a site requires email logins, it is a fail. Much of the time, by the time the authentication email arrives, the login timeout has expired.
    - nickjj 5y ago
      If a site makes it time out after 5-10 minutes that's on them. An hour should be ample time for it to be delivered while offering a decent amount of security around token availability, especially since it should be revoked as soon as it's been used once.