5 ms·

You should use a local-storage password manager, like KeePass.

stinkytaco 4y ago
I use KeePass, but keep the file in cloud storage because I need to log in from multiple places and it's a tradeoff I'm willing to make. I don't want to excuse bad security practices, but in the end I've decided I'm safer with good passwords + cloud storage than I am with possibly bad passwords because I need to retype them all the time. I feel like this is part of the reason we need real data protection laws in the US. There doesn't seem to be any downside for a company with lax security practices.
- Brian_K_White 4y ago
  Same. keepass with the db on a cloud drive. keepass clients on both laptop and phone access the same cloud copy, and also each keep a local copy. I intentionally don't let the clients integrate with the browser. I let the browser itself cache the unimportant stuff for convenience, and anything important I always paste from the password manager and have to get a code from the totp app also anyway. I don't think anyone should use a fully 3rd party full featured password manager like lastpass or onepass. I would say it is NOT better that they use that vs nothing. 'anything is better than nothing' is not true here. Some things are better than nothing, and some are not.
  - theandrewbailey 4y ago
    KeePassXC supports TOTPs out of the box and its browser integrations fill TOTP fields just like they do with password fields. I love that the browser integrations check logins by domain, and shows a popup when it finds one. Manually copying and pasting logins is susceptible to phished domains, even the lookalikes with visually similar/identical Unicode characters.
    - Brian_K_White 4y ago
      Maybe I will revisit this policy. Thanks.
- pieter_mj 4y ago
  Also, you could add an extra key (can be any file, so you would need passphrase+key) and keep only the key offline on each device.
the_snooze 4y ago
Don't let perfect be the enemy of the good. Many people won't use a password manager at all if it has no cross-device syncing, and that almost always means a cloud implementation. Sure, it's less secure than a pure local-only password manager, but it's way more secure than not using a password manager at all.
sigmoid10 4y ago
That only works if you stick to a single device. If you use many devices or frequently switch between different devices, you'll want portability.

I use KeePass, but keep the file in cloud storage because I need to log in from multiple places and it's a tradeoff I'm willing to make. I don't want to excuse bad security practices, but in the end I've decided I'm safer with good passwords + cloud storage than I am with possibly bad passwords because I need to retype them all the time. I feel like this is part of the reason we need real data protection laws in the US. There doesn't seem to be any downside for a company with lax security practices.

Brian_K_White 4y ago
Same. keepass with the db on a cloud drive. keepass clients on both laptop and phone access the same cloud copy, and also each keep a local copy. I intentionally don't let the clients integrate with the browser. I let the browser itself cache the unimportant stuff for convenience, and anything important I always paste from the password manager and have to get a code from the totp app also anyway. I don't think anyone should use a fully 3rd party full featured password manager like lastpass or onepass. I would say it is NOT better that they use that vs nothing. 'anything is better than nothing' is not true here. Some things are better than nothing, and some are not.
- theandrewbailey 4y ago
  KeePassXC supports TOTPs out of the box and its browser integrations fill TOTP fields just like they do with password fields. I love that the browser integrations check logins by domain, and shows a popup when it finds one. Manually copying and pasting logins is susceptible to phished domains, even the lookalikes with visually similar/identical Unicode characters.
  - Brian_K_White 4y ago
    Maybe I will revisit this policy. Thanks.
pieter_mj 4y ago
Also, you could add an extra key (can be any file, so you would need passphrase+key) and keep only the key offline on each device.

the_snooze 4y ago

Don't let perfect be the enemy of the good. Many people won't use a password manager at all if it has no cross-device syncing, and that almost always means a cloud implementation. Sure, it's less secure than a pure local-only password manager, but it's way more secure than not using a password manager at all.

sigmoid10 4y ago

That only works if you stick to a single device. If you use many devices or frequently switch between different devices, you'll want portability.