4 ms·

nice list, but not sure about password managers... especially in light of what is currently going on with lastpass. a lot of phishing will come out of that to t

nice list, but not sure about password managers... especially in light of what is currently going on with lastpass. a lot of phishing will come out of that to trick users to give away their master password. then what? or what if google, apple, what have you, ban your account? there is no silver bullet. we need a lot common sense and not preaching in absolute terms.

dylan604 4y ago
>not sure about password managers... especially in light of what is currently going on with lastpass. i would counter with don't use cloud based password managers. i'd go so far as don't use cloud based anything, but that ship has sailed. i use a password manager, but do not use the cloud offerings of it. i can sync all of my devices to the same database, but yes i have to do it. >99% of people will prefer the convenience over security, so as a founding father once said, give them neither (or something like that).
knaik94 4y ago
At least Google's password manager is tied to your login, which should be a lot better protected and people wouldn't give away that password as easily. You can always export your passwords, they're not locked into a password manager.
- albuic 4y ago
  Password manager database are almost standardised for open source products.
cuu508 4y ago
> a lot of phishing will come out of that to trick users to give away their master password One thing you can do to mitigate is to set up WebAuthn 2FA for the password manager as well. If your master password somehow leaks (say, a keylogger), the attacker still cannot access the vault since they don't have access to your security key.
- eks391 4y ago
  My pw manager does not offer this. Which do you recommend that has this feature?
  - deleted 4y ago
    [deleted]
civopsec 4y ago
You know how “cloud stuff” are remote files, right? And that files can be stored locally? Well there exists a thing called encrypted password managers that are just files (a file) that are stored locally (as in not on the cloud. The storage thingy on your computer. Yeah, your laptop, exactly!) Local storage: it’s a thing.

dylan604 4y ago

>not sure about password managers... especially in light of what is currently going on with lastpass. i would counter with don't use cloud based password managers. i'd go so far as don't use cloud based anything, but that ship has sailed. i use a password manager, but do not use the cloud offerings of it. i can sync all of my devices to the same database, but yes i have to do it. >99% of people will prefer the convenience over security, so as a founding father once said, give them neither (or something like that).

knaik94 4y ago

At least Google's password manager is tied to your login, which should be a lot better protected and people wouldn't give away that password as easily. You can always export your passwords, they're not locked into a password manager.

albuic 4y ago
Password manager database are almost standardised for open source products.

cuu508 4y ago

> a lot of phishing will come out of that to trick users to give away their master password One thing you can do to mitigate is to set up WebAuthn 2FA for the password manager as well. If your master password somehow leaks (say, a keylogger), the attacker still cannot access the vault since they don't have access to your security key.

eks391 4y ago
My pw manager does not offer this. Which do you recommend that has this feature?
- deleted 4y ago
  [deleted]

civopsec 4y ago

You know how “cloud stuff” are remote files, right? And that files can be stored locally? Well there exists a thing called encrypted password managers that are just files (a file) that are stored locally (as in not on the cloud. The storage thingy on your computer. Yeah, your laptop, exactly!) Local storage: it’s a thing.