5 ms·

People are joking about obvious bad choices like Excel, but I am really not sure what is really safe anymore. For example, I am using Dashlane, should I change

People are joking about obvious bad choices like Excel, but I am really not sure what is really safe anymore. For example, I am using Dashlane, should I change it? If so, how?

Saris 4y ago
The safest choice is KeePass since it's designed well for security, and stores your database locally.
- anshumankmr 4y ago
  I have two OSes on my laptops and both iOS and Android, so I can probably manage except maybe on my office laptop. My parents are a part of my family plan and I don't see them being able to use it.
  - otachack 4y ago
    Separate your work and personal data, including passwords. That way if you ever leave the job it's and simple as leaving the password manager entity and not having to clean out your personal bank of passwords.
  - luma 4y ago
    Keepass is FOSS and there are compatible clients for basically every OS you might think of, including IOS, Android, OSX, Windows, and Linux. It does not include multi-device sync, but it works nicely with other solutions that provide that function. So drop in your preferred file sync solution (ideally, cloud-free) and you're all set.
- deleted 4y ago
  [deleted]
jb3689 4y ago
A notebook under my bed seems to have fewer attack vectors than anything on a networked device
- yreg 4y ago
  Ye, but then you can log in only when you are home and lay in bed.
  - antiframe 4y ago
    That's a feature, not a bug.
GrabbinD33ze69 4y ago
I don't understand why tech savvy people are doubting the security of a pw manager with a strong master pw; this wasn't a failure caused by a flaw in the concept of a pw manager itself, but by a company's shitty implementation and design (I mean c'mon, certain fields were encrypted but others weren't, and they didn't make it super obvious?).
- TillE 4y ago
  People are...very confused if their reaction to this is "cloud password manager bad". If only well-encrypted data were leaked, it really wouldn't be a big deal. A properly designed online password manager is an extremely safe choice.
  - GrabbinD33ze69 4y ago
    Exactly... of the relatively tech savvy people I know who use this incident as some sort of vindication for their choice to not use a pw manager, are the same people who either store passwords in plaintext electronically, or write them down but use passwords that have a weak keyspace and are under 10 chars. I'm pretty sure I read an article from a month ago wherein 4 rtx4090s could chew through the hashes of 8 char passwords with a strong keyspace in a few days or hours.
- GrabbinD33ze69 4y ago
  To add to my comment, if one's response is to point out it's difficult to trust the company's opsec, handling of your data etc then use something like bitwarden. If a fully open src online pw manager doesn't calm your nerves, self host it.

People are joking about obvious bad choices like Excel, but I am really not sure what is really safe anymore. For example, I am using Dashlane, should I change it? If so, how?

Saris 4y ago

The safest choice is KeePass since it's designed well for security, and stores your database locally.

anshumankmr 4y ago
I have two OSes on my laptops and both iOS and Android, so I can probably manage except maybe on my office laptop. My parents are a part of my family plan and I don't see them being able to use it.
- otachack 4y ago
  Separate your work and personal data, including passwords. That way if you ever leave the job it's and simple as leaving the password manager entity and not having to clean out your personal bank of passwords.
- luma 4y ago
  Keepass is FOSS and there are compatible clients for basically every OS you might think of, including IOS, Android, OSX, Windows, and Linux. It does not include multi-device sync, but it works nicely with other solutions that provide that function. So drop in your preferred file sync solution (ideally, cloud-free) and you're all set.
deleted 4y ago
[deleted]

jb3689 4y ago

A notebook under my bed seems to have fewer attack vectors than anything on a networked device

yreg 4y ago
Ye, but then you can log in only when you are home and lay in bed.
- antiframe 4y ago
  That's a feature, not a bug.

GrabbinD33ze69 4y ago

I don't understand why tech savvy people are doubting the security of a pw manager with a strong master pw; this wasn't a failure caused by a flaw in the concept of a pw manager itself, but by a company's shitty implementation and design (I mean c'mon, certain fields were encrypted but others weren't, and they didn't make it super obvious?).

TillE 4y ago
People are...very confused if their reaction to this is "cloud password manager bad". If only well-encrypted data were leaked, it really wouldn't be a big deal. A properly designed online password manager is an extremely safe choice.
- GrabbinD33ze69 4y ago
  Exactly... of the relatively tech savvy people I know who use this incident as some sort of vindication for their choice to not use a pw manager, are the same people who either store passwords in plaintext electronically, or write them down but use passwords that have a weak keyspace and are under 10 chars. I'm pretty sure I read an article from a month ago wherein 4 rtx4090s could chew through the hashes of 8 char passwords with a strong keyspace in a few days or hours.
GrabbinD33ze69 4y ago
To add to my comment, if one's response is to point out it's difficult to trust the company's opsec, handling of your data etc then use something like bitwarden. If a fully open src online pw manager doesn't calm your nerves, self host it.