3 ms·

My go-to recommendation has been Bitwarden, but if you're worried about an external dependency and don't want to run their self-hosted option, then I've found K

My go-to recommendation has been Bitwarden, but if you're worried about an external dependency and don't want to run their self-hosted option, then I've found KeePassXC to be fantastic too. I have to use it on my client development macbook due to their security rules and was initially very reluctant to move away from Bitwarden. The client's security dept says no password manager can request stuff from outside the machine it's installed on. KeePassXC is a little clunky to set up the link between your local instance and your browser(s) but once that is done, it's straightforward and seems to work very well. EDIT: Bitwarden recently added passphrases to its generator feature. I personally prefer long random passwords but I know some folks prefer to remember a phrase.

btschaegg 5y ago
I can say the same re: KeepassXC. I'm using it on all my devices (except Keepass2Android on my phone) and synchronize the database using Syncthing. Works like a charm. The one gripe I have with it is its KeeAgent emulation on Windows: It works with Putty (AFAIK) and Microsoft's official OpenSSH port (which gets more and more out of date), but it doesn't mesh well with MSYS2 or Cygwin. And interoperability between those is still really poor.
diarrhea 5y ago
Your edit conveys a strong anti pattern, at least in the sense password managers are mostly used. The entire point is to not remember passwords. Hence the name LastPass, for example (“the last password you will have to remember” aka the master password). Hence also completely random, entirely impossible to learn passwords. However! The passphrases are very useful for situations where the password also needs to be remembered and actually typed by hand on occasion. I have a single such case, my Active Directory work account. Need to login to Windows but also to various platforms in the browser.
- Benjamin_Dobell 5y ago
  I don't think this is true. That just seems like marketing spin for your average consumer who doesn't understand security. The main motivation is having a different password per service. So if your password is compromised in one place, you're not universally compromised.
  - diarrhea 5y ago
    > The main motivation is having a different password per service. So if your password is compromised in one place, you're not universally compromised. Yes, exactly. But how many logins does the average user have? Dozens at least. What's a secure password? 12+ elements (alphanumeric and specials). That is impossible to keep in your head. The only way the average person can make use of complex, secure passwords is by having a single one and reusing that. This is where password managers come into play. You simply create unique passwords, with strong security to each. Again, these will be impossible to remember. So the entire point of passphrases is moot: you are not supposed to remember them, let alone know them. Yes, not even know them. It's the password manager's job! The only exception (I know of) is passwords that need to be entered regularly, offline, like the operating system's login screen. Those better be passphrases: they can be remembered, but can also be made secure enough by modern standards. The master password to my password manager is such a passphrase, with some modifications. So is the login to my AD user (here, and only here, I used the passphrase generator). That's it. The rest are very long, randomly generated passwords (not phrases), of which I know none. This is, to my knowledge, the "idiomatic" and "correct" way of using password managers today.

btschaegg 5y ago

I can say the same re: KeepassXC. I'm using it on all my devices (except Keepass2Android on my phone) and synchronize the database using Syncthing. Works like a charm. The one gripe I have with it is its KeeAgent emulation on Windows: It works with Putty (AFAIK) and Microsoft's official OpenSSH port (which gets more and more out of date), but it doesn't mesh well with MSYS2 or Cygwin. And interoperability between those is still really poor.

diarrhea 5y ago

Your edit conveys a strong anti pattern, at least in the sense password managers are mostly used. The entire point is to not remember passwords. Hence the name LastPass, for example (“the last password you will have to remember” aka the master password). Hence also completely random, entirely impossible to learn passwords. However! The passphrases are very useful for situations where the password also needs to be remembered and actually typed by hand on occasion. I have a single such case, my Active Directory work account. Need to login to Windows but also to various platforms in the browser.

Benjamin_Dobell 5y ago
I don't think this is true. That just seems like marketing spin for your average consumer who doesn't understand security. The main motivation is having a different password per service. So if your password is compromised in one place, you're not universally compromised.
- diarrhea 5y ago
  > The main motivation is having a different password per service. So if your password is compromised in one place, you're not universally compromised. Yes, exactly. But how many logins does the average user have? Dozens at least. What's a secure password? 12+ elements (alphanumeric and specials). That is impossible to keep in your head. The only way the average person can make use of complex, secure passwords is by having a single one and reusing that. This is where password managers come into play. You simply create unique passwords, with strong security to each. Again, these will be impossible to remember. So the entire point of passphrases is moot: you are not supposed to remember them, let alone know them. Yes, not even know them. It's the password manager's job! The only exception (I know of) is passwords that need to be entered regularly, offline, like the operating system's login screen. Those better be passphrases: they can be remembered, but can also be made secure enough by modern standards. The master password to my password manager is such a passphrase, with some modifications. So is the login to my AD user (here, and only here, I used the passphrase generator). That's it. The rest are very long, randomly generated passwords (not phrases), of which I know none. This is, to my knowledge, the "idiomatic" and "correct" way of using password managers today.