17 ms·

Ask HN: I have 176 logins/accounts. How many do you have?

185 points by bojangleslover 3y ago

Here is a screenshot of my Bitwarden: https://imgur.com/a/UdG7Inb They include some really important things such as: Health insurance G-Suite for work Bill.com (which I use to get paid) IRS.gov (which I use to get un-paid) UK Companies House Register Interactive Brokers My bank Obviously, anything with OAuth is "bundled" into my Google account. So if anything this is a huge underestimate. I'm asking because of how insane auth has become. I know companies like OnePassword and Bitwarden are working on this and overall they do a great job. But I still have a near-stroke every time I have to do the "forgot my password" loop, or use Duo Mobile/other 2FA. The only really good auth feature I've ever encountered has been Apple's "fill from Messages" feature as well as their Touch.

throwaway019254 3y ago
800 logins in my Bitwarden. These are logins I collected over the last 15 years. A lot of them are for pages that don’t event exist anymore.
SAI_Peregrinus 3y ago
751 entries in my KeePassXC database. I'm sure a number of those accounts are for long-dead sites, and many of the rest are throwaways I don't expect to use again.
sieabahlpark 3y ago
[dead]
simonjgreen 3y ago
1,742 according to my Bitwarden on Logins :grimace: Given my use of password managers goes back to pre 2000 I'm willing to bet a sizeable percentage of the sites don't even exist any more
ftxbro 3y ago
this is nuts, i was expecting people to say like 8
rasse 3y ago
800+ entries linked to 784 unique email addresses.
beaugunderson 3y ago
1Password tells me I have 4,182 items... and that's probably not even everything.
ddp 3y ago
1112+, plus 25 in Microsoft Authenticator w/ cloud backup enabled, and a Yubikey 5c FIPS for every device I care about.
skyzyx 3y ago
Over 900.
davidblue 3y ago
Definitely a relevant topic, I'd say, especially if the discussion help any stragglers over the "edge" into finally using a password manager. (As far as I'm concerned, it is absolutely a requisite for all digital citizens in 2023.) ((And kinda has been for 10+ years but ya know.)) I'm closing in on 5000 credentials in 1Password, personally, but my collected vaults/database is 15+ years old now and definitely has [problematic duplicates](https://github.com/1Password/solutions/issues/1 https://github.com/1Password/solutions/issues/1). After a lengthy-enough sample of semi-formal self-observation, I'm averaging: - signing in/authenticating 10 times/day (including weekends,) and most of those are repeats with the same service. - Almost 10 new accounts/credentials per week. (Granted, I'm pretty darn indiscriminate about doing so while exploring.) Without tangenting too far, if anyone has any advice about how to constructively normalize password management (even just as an abstract) for end users - whatever that may mean - I'd love to hear it.
rollopack 3y ago
In Firefox's about:logins I have 1333 saved credentials
kdne_jdnf 3y ago
About 500-600 items
LorenDB 3y ago
I have 93 personal accounts in my Bitwarden, plus 13 that I have categorized as "deprecated". I don't think 176 is wildly unusual; it may be a bit higher than some people, but it's certainly not a Guinness World Record or anything like that.
bombcar 3y ago
The elites don’t want you to know this but the accounts on the Internet are free you can take them home I have 458 accounts.
- Onavo 3y ago
  [flagged]
  - dang 3y ago
    Can you please not post unsubstantive comments or political flamebait (or other flamebait) to HN? You've already done it repeatedly with this account. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- belter 3y ago
  Every time you "log-in", you're increasing your carbon footprint :-)
  - bombcar 3y ago
    Most of the logins are sequestered in the password manager, for which I get a moderately decent subsidy from the government.
c17r 3y ago
According to Bitwarden, 479 accounts
- distances 3y ago
  Hehe exactly the same number I have in KeePassXC, 479. I'm pretty sure many of these services have shut down years ago.
1827163 3y ago
182 logins here, although most of them aren't used frequently.
escapedmoose 3y ago
326
davidn20 3y ago
515 - thank you Jesus for password managers
aed 3y ago
Interesting question! I just checked and, wow, I have 922 accounts in 1password. (From 10+ years of use.) It’s funny you bring this up because I’ve thought about “cleaning up” 1password before. But all the extra accounts are not really in my way. I never use oauth (like to create a new account / password for everything). All of my work-related accounts are in there from several employers. Lots of passwords for (probably dead) servers. I count 28 logins for salesforce.com from past employers, various sandboxes, and consulting gigs.
- kylehotchkiss 3y ago
  The archive feature is nice for cleanup. It doesn’t delete, just hides from lists and searches. I’ve un-archived many items before.
- ryan29 3y ago
  > I never use oauth (like to create a new account / password for everything). Me too. I have 672. Lots are for accounts I set up for nieces/nephews, etc., so those don’t really count. I bet 100 are stale as well I’ll clean them up one day. Lol.
suddenclarity 3y ago
Slightly below 2000 last time I looked. Most sites don't support deleting content or accounts. In best case they just "anonymize" you. So it just keeps growing...
neon_electro 3y ago
1,226 items in my 1Password database. Very happy customer.
insomniacity 3y ago
So if anything with OAuth is tied to Google, how would you survive losing your Google account?
- firecall 3y ago
  For this reason I stopped using Google / OAuth a couple of years back!
drakonka 3y ago
I currently have 344 accounts in my password manager.
KomoD 3y ago
939 accounts in 1PW
BaudouinVH 3y ago
https://i.imgur.com/QHMavTm.png https://i.imgur.com/QHMavTm.png 1078 - many I of them I've used once
gepiti 3y ago
Only 375.
achairapart 3y ago
I really don't know how many accounts I have, for most of them I don't even store passwords, I just generate them in a deterministic way with a little password generator I made[0]. Some time ago I realized what a waste was to store so many secrets, even more knowing that for the most part I'll probably never need them again. For the - proportionally few - important secrets, I use (and really like) Pass[1]. [0]: https://aprico.org https://aprico.org [1]: https://www.passwordstore.org/ https://www.passwordstore.org/
- gnrlst 3y ago
  Aprico is a neat idea, but as soon as you face a website that has stupid requirements like a character limit, specific banned characters (like symbols), or other it has no way of adjusting for that and you have to start tracking exceptions. It also has a 1-1 limit of website, unless you come up with service naming heuristic as well. Regardless of these limitations (which I realize are edge cases and very much not the point of the service), it's a nice, simple idea :)
  - xp84 3y ago
    Don’t forget the even stupider variant, the allow-list of like 5 symbols. “Tell me you failed infosec 101 without telling me you failed infosec 101.”
    - NegativeK 3y ago
      There's a local government website that requires eight or fewer characters, and the eighth character has to be a digit. They've tried to change the requirement, but it comes from vendor software. The vendor just waves around a middle finger and points to the contract.
  - achairapart 3y ago
    Anectodal from a few years of use, surprisingly those stupid requirements are almost a thing of the past nowadays. But yes, some edge cases still require some bits of muscle memory, which may be your thing, or not. I'm a bit ashamed that I never found the time to write down some docs, so I never really shared it, apart from a few friends and colleagues. On desktop, the web extension is quite convenient, it will autofill everything for you but the master password. On iOS, I made a simple shortcut[0] where you share a url and - thanks to the os autofill - you just get your password copied into the clipboard, no input required at all. Also, on Android there is something similar using the PWA Web Share Target API. And that's it, thanks for your kind words. [0]: https://www.icloud.com/shortcuts/2dcb6680e6b3424d8708e673e1af67e5 https://www.icloud.com/shortcuts/2dcb6680e6b3424d8708e673e1a...
gnrlst 3y ago
600+
manuelmoreale 3y ago
410 according to 1 Password. I do periodic cleanups though and I should probably do one soon so the number of actual, in use, logins is probably lower.
alxjsn 3y ago
633
marssaxman 3y ago
There are 92 entries in my credentials archive. I try to avoid creating them if at all possible, and I never use OAuth.
karmakaze 3y ago
> But I still have a near-stroke every time I have to do the "forgot my password" loop, or use Duo Mobile/other 2FA. That's funny, I've stopped caring about remembering most passwords and use the "forgot my password" loop as a login mechanism for rarely accessed sites/services. I also only enable 2FA on important ones like email, github, or banking. Basically my threat model includes my ability to lose things.
- pacifika 3y ago
  This works until you want to change your email domain (or provider in some cases)
deathtrader666 3y ago
1300 as per 1Password.. and must be 500+ in my old Firefox account that I didn't bother exporting.
AH4oFVbPT4f8 3y ago
1322 currently in Bitwarden
KronisLV 3y ago
Around 300 at this point, sans any deleted ones. I don't think I know a single password anymore, since they're all randomized and separate for each site. > Obviously, anything with OAuth is "bundled" into my Google account. Maybe it's just me, but I try to never use centralized identity providers (outside of things that I really don't care about) and use separate e-mail auth whenever possible, across multiple e-mail accounts (some self-hosted). Same with considering separate Google accounts for phones, services like e-mail, a separate one for any content creation on YouTube and so on (ideally without any of them coming in contact with one another). The idea is that one account getting closed/suspended shouldn't result in ALL of the linked stuff becoming inaccessible. I don't even do anything weird online, it's just that nowadays you hear lots of stories about people getting banned based on some heuristics by automated systems, with no ways of getting in contact with the support. Even something like a VPN might trip those systems up. Similar things have happened to me before (a SaaS provider didn't want to do business with me) for no good reason even without a VPN, but trying a year later with the same credit card didn't result in the other account being auto-suspended. How odd. I guess the next step would be to have usernames, phone numbers and even payment methods (apparently virtual credit cards sometimes work) also be more randomized and more compartmentalized, though something tells me it'd be a pain to do that. That said, I largely believe that privacy online is mostly dead due to how much fingerprinting there is, though one can still protect themselves from automated systems acting weird, because nobody genuinely cares about that, at least at the scale where they're needed.
- Froedlich 3y ago
  I have about 150 accounts, though some of them are logins for vendors I dealt with once, a decade or more ago. > I guess the next step would be to have usernames, phone numbers and even payment methods (apparently virtual credit cards sometimes work) also be more randomized and more compartmentalized, though something tells me it'd be a pain to do that. --- I do that. It's no trouble. I use various usernames to 'fuzz' tracking. Yes, anyone who really cared could track me by my IP address, but trackers are like whales sieving krill; they get so much, they don't bother to look very hard.
- xp84 3y ago
  > people getting banned … with no ways of getting in contact with the support This is the most out-of-whack part in my humble opinion. Most of us have a tremendous amount of data and things like auth tokens tied up in Google, and Apple, and due to their scale and the fact that at least for GOOG it’s a “free service,” they’ve set the expectation up that “support” should be limited to searching an FAQ, and also that any account they ban must be some kind of troll account that shouldn’t be listened to. God forbid they give you a phone number where you could bother a person until your problem was solved. Using ad-supported services for vital stuff is risky. But I know even Apple isn’t very helpful, even for those of their iCloud users who pay.
ChoGGi 3y ago
> Obviously, anything with OAuth is "bundled" into my Google account. So if anything this is a huge underestimate. If Google ever pulls the plug on you, you're in for a bad time.
- xp84 3y ago
  I guess despite how cool it is to hate Facebook in 2023 there’s a really solid case to be made that it’s a smarter “OAuth” choice than Google, since with Google, if you fell back to resetting your password for another site to get in after a Google account shutdown, the email on the account would be the same Gmail account that you’re locked out of!
Brajeshwar 3y ago
3,995 by 1Password as of May 21, 2023.
Semaphor 3y ago
Over 500, though I have no idea how many of them still exist. I use a password manager and unique email addresses, why would I care how many accounts I have?
- hotpotamus 3y ago
  What are you using for unique email accounts? DIY or some service?
  - Semaphor 3y ago
    DIY on fastmail with custom domain.
aranke 3y ago
203 according to 1password, but I archive the ones I don't need roughly every year.
web3-is-a-scam 3y ago
Hundreds. I’ve lost count they’re all in 1Password.
MacsHeadroom 3y ago
About 1,400 in KeePass. Perhaps a poll would with ranges would have been better. 0-100 101-300 301-800 801-1200 1200+
- jeanlucas 3y ago
  Indeed, although it would not be that hard to parse all replies and plot it.
deleted 3y ago
[deleted]
arisAlexis 3y ago
You mean since I started using the internet in 1995? Or only live ones
dt3ft 3y ago
What is bitwarden doing to help lower the number of accounts, exactly? I'm out of the loop.
- NegativeK 3y ago
  Bitwarden lowers the mental burden for secure (which includes unique) passwords, precisely because we have a crap ton of accounts.
plantroon 3y ago
I have 728. Before Bitwarden I used password store. I migrated with a script about 2 years ago, and I still don't have all the necessary metadata in at least a half (meaning there is no icon, usernames are messy, etc). I only update the old entries whenever the accounts are needed, meaning that I haven't used half of them in 2 years. So I "actively" use about 360 accounts on various services.
ctoth 3y ago
Exactly 256 in Keepass currently.
freitasm 3y ago
I have 872 according to BitWarden: https://cdn.geekzone.co.nz/imagessubs/3c01663b43a16e0b50577a8d1d95f368.jpg https://cdn.geekzone.co.nz/imagessubs/3c01663b43a16e0b50577a... I don't use OAuth, except for two services - which I could switch to user/pass if I really wanted.
bastijn 3y ago
My password manager says 407 currently in my vault. I only use social login for very very limited amount of sites. My default option is to create app/site specific accounts so I can append my email with +sitename to see who leaks my data.
SoftTalker 3y ago
A bit under 200, but only around 20 that I use with any regularity.
jeroenhd 3y ago
Bitwarden lists 791. A ton of them are for internal services/local dev accounts/what have you, but that's still a pretty long list. I don't use most of them. A third of them are for my spam email address. I'm starting to notice Bitwarden taking its sweet time decrypting them all, though.
morkalork 3y ago
Shit, just looking at the replies, there's a solid case for password managers. No normal human is going to memorize 100+ unique passwords meeting various complexity requirements. It almost makes shaming people for re-using passwords look like you're out of touch. Of course they're following bad practices, how could they not be?!
- pugworthy 3y ago
  Or a solid case for alternatives to standard username / password login concepts.
- causality0 3y ago
  I take a pragmatic approach: the dozen logins in my life that actually matter get strong unique passwords, and everything I don't give a shit about gets the same password.
  - Misdicorl 3y ago
    I take the same approach with the extra precaution that those logins also get a separate email address (with a different pseudo-strong password). Makes it really easy to share nonsense logins with my wife/family.
  - lwhi 3y ago
    It's not pragmatic, it's dangerous. Sooner or later someone could take control of one of the accounts you don't care about and use in a way you don't expect to gain control of things you do care about.
    - Dalewyn 3y ago
      Beyond my accounts related to my important email addresses, Steam, finances and medical which can all be counted on one or two hands, I really couldn't give a damn about the other accounts or their password security. Strong and unique passwords for the important accounts, simple and reused passwords for the rest. You're welcome to hack into my accounts on Hacker News, Reddit, Discord, LINE, various IRC networks, various forums, etc. I don't care; there's nothing important in there besides sentimental value.
tananaev 3y ago
963 in Bitwarden
colinmegill 3y ago
241 in 1password 340 in Google Password Manager
akira2501 3y ago
If I need to login to your site less than once or twice a year, "Forgot my password" is my password manager. Personally, I feel that the utility of me working to keep and maintain that information in a database for high availability is essentially zero. As a result, I store very few accounts overall and checking out as "guest" hasn't been a problem of any sort. There's like 10 critical things that I feel the need to store the password on and they all use a hardware key for 2fa anyways. For the two accounts that I absolutely can't lose access to, I just used the "Correct Horse Battery Staple" method and came up with two very long and secure passwords that I have no trouble remembering.
- rhn_mk1 3y ago
  A password manager is not just a way to manage passwords. It's also a way to manage who holds your personal data, so you can GDPR request them to stop.
  - kdklol 3y ago
    This. It's so valuable just to know how exposed you may be. I know a guy who missed a data leak and later got one of his accounts stolen. I think his Steam? It was way back in the day... For him, it was a cheap reminder to take passwords hygiene seriously. For someone else, it could have been a someone-took-out-a-line-of-credit-in-my-name reminder.
- jay_kyburz 3y ago
  Yeah, I'm the same. Google and a few others. The rest all just get the new password that Firefox suggests and I don't even pay attention to what it is.
- cheeze 3y ago
  I just use a crappy password. It's been leaked before. I don't care. If someone wants to take over my last.fm account that I haven't used in 3 years, sure go for it. The important accounts get a randomly generated password stored in my password manager. And the really important accounts only have half the password saved, I manually fill in the other half.
tgv 3y ago
360 for websites (most of which I've only used once; the oldest are dated 2011, but those are probably import dates, as they all have the same timestamp), and 100 or so for more serious stuff (banking, routers, etc.) in KeePassXC.
jeanlucas 3y ago
952, I store accounts user and passwords that I have since 2011, and I like to try new services. Especially to give feedback to makers.
daneel_w 3y ago
My keychain has 54 items in it. I think at least 5 of them belong to things I've shut down.
sigio 3y ago
about 750 in my personal 'pass' store, and about a 1000 in the shared password store for work. Bitwarden probably has a significant subset, but I prefer to keep 'pass' as authoritative source.
hhh 3y ago
600 in Chrome. 800 in iCloud Keychain. I assume there's a % of duplication between the two, since I don't really use Chrome anymore outside of Windows.
varenc 3y ago
1259 on 1Password! https://dl.dropboxusercontent.com/s/4ug9qyk67z9pkml/Screen%20Shot%202023-05-21%20at%2010.39.51%20AM.png https://dl.dropboxusercontent.com/s/4ug9qyk67z9pkml/Screen%2... Still using 1Password 7 and its self-hosted vaults with the 1Password app denied all network access. This is good reminder that I should login to all my old Google accounts to keep them from being deleted since Google is finally making moves to erase accounts unused for over 2 years. (especially given how it's always getting more difficult to create new G accounts)
nickjj 3y ago
$ pass | wc -l 321 17 of those are encrypted notes (API tokens, license keys, etc.). `pass` is a command line password manager: https://www.passwordstore.org/ https://www.passwordstore.org/
- zikduruqe 3y ago
  $ pass |wc -l 176 Was hoping to be the only cool kid posting pass counts... :)
- aendruk 3y ago
  $ gopass list --flat | wc --lines 575
- sirodoht 3y ago
  I love pass! $ pass|wc -l 1252
- philsnow 3y ago
  % bw list items | jq length 494 I used pass for years, but eventually quit when needing to rekey the gpg stuff for the fifth time and it being a pain to provision another key for passforios. It looks like there's some work to let pass use age for crypto instead of gpg, but I don't know if that's been ported to passforios or any of the other pass-compatible mobile apps. Pass using git as its storage backend doesn't make a whole ton of sense for me. It's convenient enough for syncing if you use a public git host, but it's got a lot of unnecessary power. More than a few times I had to merge by hand when I had changes from both my laptop and my phone. I use vaultwarden these days and it's pretty great. I wrote a (gross, ugly, but that's fine because I used it exactly once) thing to migrate from pass to bitwarden/vaultwarden, https://github.com/philsnow/pass-to-bitwarden https://github.com/philsnow/pass-to-bitwarden edit: forgot to mention, if you don't care about using Bitwarden the company for hosting, they have a somewhat generous free-forever tier https://bitwarden.com/pricing/ https://bitwarden.com/pricing/
browningstreet 3y ago
944 items in 1Password (fingerprint me!) I'd have more but even 1Password doesn't always catch when I'm creating an account login, or resetting a password, etc. I do the work to input some of them, but not always (I get lazy). I do try a lot of tools, and I have a lot of personal and professional GMail OATH logins too, which -- fortunately -- 1Password now tracks.
nyadesu 3y ago
319, currently using Bitwarden to manage them and been pretty happy with it so far
aaronax 3y ago
I would not expect any true innovation to come from companies such as 1Password or Bitwarden. They make money off authentication being so craapy that an entire class of applications has sprung up around it. They will not innovate themselves out of existence.
lorenzk 3y ago
809 in Bitwarden. Collected and migrated over the years from lastpass to enpass to bitwarden.
zimpenfish 3y ago
1456 items in Bitwarden; 1180 have both username and password but there's a lot of duplication - e.g. I've got 6 items for my local nzbget instance (all the same u/p combo.) This is an accumulation since ~2010 starting with 1Password, then LastPass, then Bitwarden. [edit: 1339 items have a password but only 1180 of those also have a username]
- lukevp 3y ago
  Do you know you can add multiple URLs to the same un/pw and it will autofill on more sites?
crooked-v 3y ago
The most infuriating auth-related thing for me is the companies that insist on doing phone-based 2FA. I'm inextricably linked to my specific phone number at this point in a way that previously was only an issue with my email address.
- willtemperley 3y ago
  This. SMS 2FA has been considered insecure by NIST since 2016 [1] and it's a major pain when travelling and swapping sim cards. [1] https://www.theregister.com/2016/07/24/nist_says_sms_no_good_for_authentication https://www.theregister.com/2016/07/24/nist_says_sms_no_good...
  - tornato7 3y ago
    The best solution is to create a Google Voice account and use that number for 2FA
    - rtsil 3y ago
      Until Google decides to retire Google Voice...
    - NoZebra120vClip 3y ago
      Many MFA implementations will detect and disallow the use of VoIP numbers... for security reasons.
      - twodave 3y ago
        Yep, and this is because sim-jacking is actually less profitable than just finding records of people’s _past_ phone numbers and signing up for a voip service that supports sms for that number. And many of the voip providers just don’t do any kind of fraud prevention. Source: I work at a place that is a natural target for this kind of thing.
  - Biganon 3y ago
    I was thinking this with my health insurance website (which uses SMS 2FA), and I realized the problem is you can't expect your average Joe to know how to manage a TOTP 2FA correctly. SMS might not be the most secure, but it's probably better than 1FA, and absolutely everyone can use it. Enter your number, receive text, boom.
uguuo_o 3y ago
Personal ~10 Work related maybe ~20
jimnotgym 3y ago
Around 1,000 in 1password. I use 1password because many of them are shared. Edit. That is only my work 1pass. I have a personal instance too with a few hundred.
- pimlottc 3y ago
  I'm curious, do you actually have ~1,000 work-related accounts? Or second accounts/alts for various non-work sites using your work email?
  - jimnotgym 3y ago
    I have zero non-work sites on my work email. Crazy isn't it. Not everything is a login, and not everything is a password. There are keys in there for instance, and some credit cards. The majority are logins though. Crazy, isn't it.
gjsman-1000 3y ago
And I thought I was out of hand with 496 in 1Password… now it feels quaint looking around here.
smcleod 3y ago
Looks like I have 2160 in Strongbox (recently moved from 1Password).
bin_bash 3y ago
176 sounded so low to me I wasn’t sure if you were talking about for all sites or just HN alts.
_benj 3y ago
Before posting I was looking at the comments to see how bad I was… after seeing 1k+ it seems like I’m fine with my 627 bitwarden items!
moltar 3y ago
1000s
thr0waway001 3y ago
Personal ones close to that. But as a contractor, way more than than 176.
efitz 3y ago
I have 921 items in 1Password; most of them are logins.
mfontani 3y ago
380+ logins on bitwarden 45+ 2FA on Authy 2 yubikeys It gets... pretty confusing, especially as I've not checked the gopass repo, where I keep _other_ stuff, too...
rtsil 3y ago
1105 according to Keepass. Although at least a third of these are no longer active.
- johnorourke 3y ago
  woop another Keepass user!
whstl 3y ago
I'm probably the one with the least. I have 35 in my password manager. I purge the ones I don't need every 2 or 3 months. I even gave away GOG and Steam accounts to friends after years of not playing games. Sometimes I have to send a threatening email to delete some accounts. Currently there's about 2 I'm waiting for an answer. It's gotten worse lately: people just don't delete your account anymore :D. Because of that, I use "hide my email" and put fake personal data pretty much everywhere now. When I REALLY don't care or am just checking the service, I use a burner email. I honestly wish I had close to zero. I really hate SaaS and I really hate websites that require a login for stupid stuff (like... a barbershop that needs login/password for scheduling haircuts? fuck off).
- lexandstuff 3y ago
  I'm confused about what you're fucking off. Would you prefer to schedule haircuts via a call or an anonymous online form? Being able to schedule appointments online is one of the big wins of modern life imo: it beats waiting around on hold and laboriously explaining to the receptionist how to spell my last name.
  - rhn_mk1 3y ago
    There are things that work anonymously (or at least pseudonymously) already: pizza delivery or hotel booking. It's not like the data presented at a random registration form has to reflect your government ID. Skipping the login step just saves the hassle, and preserves the win of being able to do things online.
    - whstl 3y ago
      Exactly. Purchasing with a guest login works fine for most shops here. In this specific case I was talking about it's even worse: I already have to click a link in the email (or answer an SMS) to confirm the appointment. It's ludicrous.
  - justsomehnguy 3y ago
    > Would you prefer to schedule haircuts via a call or an anonymous online form? Why the hell no? At worst "an anonymous form" can ask for your mobile number only to remind you about the appointment (if it's not today for example). At best it should be really optional. In both cases there is absolutely zero need for both a login and a password. I have a local pizza joint working like that - you just punch in what you need, your number with SMS code confirmation and you are in, with your address/es and pizza coins or whatever. And they have your number to contact you if anything is wrong with the order/delivery. Another one just asks for a number and call back to confirm with an operator. Why the hell I do need a login, a password and email|Facebook|whatever for a pizza delivery?
johnorourke 3y ago
Why keep score? If you have a password manager, the number is irrelevant. But: KeePass 2052. Cheating because I work for an agency... so we have hundreds of clients' passwords to store and selectively distribute to the team.
- psychphysic 3y ago
  Agreed. This is utterly baffling question. You might as well ask me how many grains there are in my salt shaker. Interesting academic question, but seeing so many people climb on their soap box is wild.
  - 93po 3y ago
    i don't find it to be a baffling question. i think the unspoken part of this is "this is a really stupid system, someone ought to do something about it". i hope in the next 20 years that password managers are a thing of the past, but for good privacy-preserving reasons.
    - pishpash 3y ago
      Wasn't the passkey article just front page the other day?
frompdx 3y ago
I have 260 items in my vault. Of course, I'm sure it could use some tidying up.
huimang 3y ago
445 logins for me on a self hosted bitwarden (vaultwarden) instance. Although a lot of those are for user & root logins to local machines I provision.
thom 3y ago
940 in 1Password (I feel a lightweight that I haven't hit 4 figures yet). Stopped fighting a while back and signed up to the cloud version instead of just having Dropbox backups, partly to help onboard my family better. Haven't regretted it yet, obviously will do if/when I find out all my stuff has been hacked but blah. Don't have numbers for my work machine upstairs, but on my phone here's how recently they were all used: 1 Day: 1 2 Days: 1 14 Days: 3 30 Days: 3 60 Days: 8 90 Days: 6 So, mostly cruft. I have a lot of stuff still done via Google auth, despite migrating all my domains and email to Fastmail couple of years back (which has been flawless since). Also, just checked, and I only have 27 entries in Authy.
StopHammoTime 3y ago
636, and I lost a lot of them about 9 years ago. I’m honestly surprised I’m not over 750.
deleted 3y ago
[deleted]
snihalani 3y ago
1072
pps 3y ago
467, says my Bitwarden :)
tkuraku 3y ago
241 logins in kepassxc
extesy 3y ago
2151 according to Bitwarden. That's what 25 years of actively using internet does to you :)
- shmde 3y ago
  2151 is insane. Share any fun/quirky/useful uncommon websites ?
pt_PT_guy 3y ago
886 according to keepassxc
donaldihunter 3y ago
1Password says 348 for me, and I know there's many more that are autogenerated and stored in a keychain.
retrobox 3y ago
More than 1000. More than I'd like. I can't help but wonder how many websites my personal information is on at this point between random shopping, forums, and all the rest.
tasuki 3y ago
206 Not counting all the sites for which I use the "Log in with Google/Facebook/etc". Many of these credentials I haven't used for years.
blitzar 3y ago
746 accounts. 746 unique passwords, ~600 unique usernames, ~600 unique email addresses.
tzhenghao 3y ago
I have over 300 on 1Password, some with more than 5 different accounts from the same site like Google and Slack. I also lean heavily on the 1Password extensions to help on the retrieval part. It's incredibly insane but I manage it by adding a namespace postfix so it's easier to identify which when autocompleting login forms. For example, "Google (Personal), "Google (UMich)" etc.
jonathantf2 3y ago
1Password currently has me at 476 logins, I assume some of those are duplicate accounts or burners.
- a10c 3y ago
  593 for me in 1Password
purplecats 3y ago
1,101
snailmailman 3y ago
Over 300 in a self-hosted vaultwarden. I’ve got my vault password memorized but that’s about it. All 300+ are secure randomly generated ones that I do not know. And I’ve got 2FA stored there too. Despite the huge number of accounts, logging into anything is seamless across any of my devices. And access to my vaultwarden is securely protected. Password managers are great. Really looking forward to vaultwarden eventually storing Passkeys as well, and using passkeys to login instead.
- an_ko 3y ago
  What's the point of 2FA if you store it in the same place as the first auth factor? Or maybe I've misunderstood. Are they behind different master passwords or something?
  - kombustor 3y ago
    As far as I understand it: The password is the "thing you know" and the password manager file is the "thing you have". So if someone compromised your email account knowing your password, they still need to access your password manager file to get access to the 2FA codes. So it's still a second factor in that sense.
  - snailmailman 3y ago
    If an individual account password leaks, the second factor still protects the account. This primarily only protects against leaked passwords from the site being hacked. Not from vaultwarden being hacked. But if my vaultwarden gets hacked I’m done anyway. They will had to have used multiple factors to get into the vaultwarden anyway. Quick edit: I’ve also got all the codes in an actual Authenticator app on my phone (so I can get into vaultwarden if I have to) But they are additionally in vaultwarden for convenience. When vaultwarden autofills, it copies the code to my clipboard and I can seamlessly pass the second factor check. Either way, access to the codes needs physical access to a device I’m already on. In practice I’m only ever logged into vaultwarden on my phone and my PC, although I could login remotely if I had to. As an additional safety measure, when my vault is logged into some monitoring software sends me a push notification through an external service.
michaelmior 3y ago
Bitwarden lists 1,601 for me. That's not counting sites that use Google, GitHub, et al. for auth which I will often choose if offered.
adontz 3y ago
183 after some recent cleanup
gzer0 3y ago
I have over 4,000 This is because I rotate accounts frequently (well, besides here).
quicklime 3y ago
312 entries, although only 37 were accessed in the last 12 months.
irrational 3y ago
According to bitwarden, I have 363. Though, I have more than that that are not stored in bitwarden. Some of them are my work accounts, others are ones I created while on mobile where it is a pain to add them to bitwarden. The real number is closer to 400.
12907835202 3y ago
I have over a thousand and hundreds of warning about compromised passwords. Annoyingly they're all for forums I was part of as a teenager 15-20 years ago with a dead email address referencing pink monkeys. I just never get round to cleaning it up.
Tempest1981 3y ago
I created a HN poll: (Underutilized feature) https://news.ycombinator.com/item?id=36025420 https://news.ycombinator.com/item?id=36025420 Sorry about the (lack of) order. Looks like it's randomized? (feature)
gigel82 3y ago
284; that's with actively trying to purge the list every 3-6 months (sometimes just an online form but for more obscure / smaller sites, it's a couple of weeks and chains of emails back and forth).
YourDadVPN 3y ago
Roughly 350, all with unique passwords and mostly with unique email addresses too. They're categorised, and the only categories with more than about 20 entries are catch-alls I never look at anyway. It's pretty useful and sometimes interesting to go on a website and find out I made an account there two years ago.
spiffytech 3y ago
My Bitwarden says 1,703. I'm surprised to see so many people with low hundreds.
metaltyphoon 3y ago
93
bikingbismuth 3y ago
Checking 1Password, I have 283. If I include sites I keep only in my brain that is probably a touch above 300.
ioman 3y ago
Went and checked my 1Password. Apparently, I have nearly 1,800! My oldest remaining password was created in 2010, so I've been using it for a while.
Havoc 3y ago
Maybe 200ish or so Loads of old crap though. Will clean it out next time I'm migrating passwd managers. Probably 50-ish that actually matter
aendruk 3y ago
With a version controlled password store you can do silly things like this: $ gource … ~/.password-store | ffmpeg … password-store.mp4 $ publish password-store.mp4 QmeN62Ewuv93epe27VmniXHUFJQLirFfEo5eM1sKdxd2m5 https://cloudflare-ipfs.com/ipfs/QmeN62Ewuv93epe27VmniXHUFJQLirFfEo5eM1sKdxd2m5 https://cloudflare-ipfs.com/ipfs/QmeN62Ewuv93epe27VmniXHUFJQ...
- mock-possum 3y ago
  well that's fun
narag 3y ago
About 200, but no more than 30 are used often and maybe 5 are important. I don't want to tell how I store them, but for these 5, I could even memorize them.
michaelsalim 3y ago
531 in my bitwarden storage. I don't create an account unless absolutely necessary. So the number is higher than I thought. I guess most of it is likely work related. I cycle through many projects. Each of them have many accounts tied to them. Eg: DNS, domain, hosting, etc etc. Not to mention all the business systems like HR.
lucb1e 3y ago
808 in my password manager, plus a few in my head (stuff like bank logins and the pwd manager's password) or cold storage (no e-money, but e.g. the manager's password and passwords to unlock system backups).
LeonB 3y ago
Over 1000 entries in my password Tracker.
lytedev 3y ago
$ pwd && fd --type file | count /home/daniel/.home/.password-store 512 Need some cleanup I supposed...
brickfaced 3y ago
KeePass says 305. That's a few decades' worth of logins across everything from Yahoo! to GMail to random online storefronts. Unique password for each. Doesn't include old accounts I've deleted where possible. Not all services offer account deletion, sadly. When I can't delete an account I leave it with blank or garbage contact info and link it to a one-off email alias for spam prevention.
ajdude 3y ago
My keepass says 484, but I have a feeling there's duplicates. I really need to curate these better.
- rout39574 3y ago
  Hah! Password count cousins! I'm 484 in lastpass.
bigburner 3y ago
Where I work 'Single Sign On' doesn't live up to its name; many of us spend the first 5 minutes of each day signing into things, waiting for the 2FA code, entering it, then rinse and repeating for a half-dozen apps.
sashk 3y ago
I have almost 1900 items in my password manager: this includes logins, software licenses, notes, etc. But this does not include items in vault Attic, where I move items which are no longer exist (dead sites, deleted accounts, old ids, etc).
bingohbangoh 3y ago
335
verandaguy 3y ago
I'm pushing 600 in my main password manager, but most of them aren't unique — I just use "farce72$" by default since it hasn't shown up in HIBP (yet -- fingers crossed) and hits three of the major character classes, so it's pretty high-entropy. The password manager mostly serves the role of autofilling stuff in browsers.
- BLKNSLVR 3y ago
  In case anyone's wondering, it's not the HN password (with or without quotes) :)
  - verandaguy 3y ago
    I wondered if anyone would try that :)
GabeIsko 3y ago
It's a good day if I can get through it without creating an account.
dot5xdev 3y ago
270 login credentials work+personal. I don't use 'sign in with Google'. I regularly try (not always successfully) to go through my 1Password vault and delete accounts that I haven't used in a while. (I wish 1Password let you order credentials by "last used". This way I could start deleting from the oldest last used accounts.) I wish I had less accounts because each account means some random website holding my data hostage. It's too common that a website doesn't allow you to delete an account. Sometimes you can find a support email and request a deletion. Other times, all I can do is try to replace my data with junk data. Although, even that isn't possible sometimes! (Rocketbook won't let you change your email, for example. Or ChatGPT saves your phone number after you delete your account.)
gaurangagg 3y ago
Earlier I used to maintain the passwords in an Excel and the life in a way changed when I discovered Password Manager KeePassXC - which is amazing. For my frequently accessed accounts, I also prefer Apple Keychain to login faster across the devices.
sevensevennine 3y ago
1Password deleted more of my accounts than that when it crashed the v8 upgrade. SK
8ytecoder 3y ago
1906 items in my 1Password. Not including those I archived or deleted.
imvictor 3y ago
https://imgur.com/G7RUsYf https://imgur.com/G7RUsYf I'm running around 838 accounts because why not? I have a unique password for each login since five years ago. I went from LastPass to 1Password and finally settled on self-hosted Bitwarden(Vaultwarden) a year ago.
smsm42 3y ago
1146 in Bitwarden. But a lot of them are old, and some accounts aren't in BW. > Obviously, anything with OAuth is "bundled" into my Google account. I too used to live dangerously. But then I took an arrow... sorry, wrong one... then I read too many stories about "Google locked my account and now my life is ruined" and stopped using Google auth with anything but the least important sites on which I wouldn't mind losing the login.
Fancy5189 3y ago
1249
INTPenis 3y ago
I have around 40 2fa codes alone, number of accounts I don't even care to count. find .password-store -type f | wc -l says 1248.
zainhoda 3y ago
373
clircle 3y ago
Presently I have 384 entries in KeepassXC, but it's not all online accounts. Sometimes I just put info in my keepass vault because I want to have easy access to it while I'm at my computer.
djha-skin 3y ago
The problem with this metric is that several of those accounts are defunct or no longer even in existence. It's much easier to add to my keypass than to delete from it
loeg 3y ago
Uh, looks like 1200. A few duplicates from LastPass or the LastPass -> 1Password migration many years ago, I forget.
aio2 3y ago
I'm not joking... I have 69 logins lol
magicjosh 3y ago
Anyone experimented with Sign in With Ethereum? Wallet based login and account management onchain.
zantsuken 3y ago
I've got about 307 on KeePassXC, with the oldest generated password from 2016. 307 includes stuff like security questions as well though, so the answer to "What is your mother's maiden name?" tends to be something along the lines of "f+2Tng+DO?X).`W/7*5IQ_"
ofalkaed 3y ago
HN and a few forums, bank, email/cloud, website (which is really just storage for ancient stuff I have mostly forgotten but occasionally have a use for) and that is about it. I use guest checkout when ever possible and if I buy from a site which does not offer it I just close my account as soon as I finish checking out. I never made the switch to password managers and the like. I have all of my passwords memorized.
wintorez 3y ago
364
abrkn 3y ago
1,413
petarb 3y ago
1955
aslilac 3y ago
238 according to 1Password. Every time I add a new one I feel a piece of my soul leave my body.
anonzzzies 3y ago
899 in Bitwarden and that is after cleaning and excludes ‘lazy’ accounts I logged into with google or facebook (those I generally don’t use or find important).
dotancohen 3y ago
My password manager has four digits of credentials stored. It dates back to when years began with the digit 1. Certainly _most_ of those are no longer in use, but maybe the time has come to see if Taco is still posting to Chips & Dips.
nikolay 3y ago
Between 3,000 and 4,000 (1Password no longer shows the count).
_8j50 3y ago
Please tell me you let chrome save and sync your passwords lol. Always a delight for pentesters and real attackers a like when people do that.
kdklol 3y ago
My BW stands at 52 logins right now, but it's not yet quite complete. I think I'm missing a couple banks. Over the last year or so however, I cancelled almost 100 accounts, ranging from obscure forums, trough hosting providers, to facebook. It was a herculian effort, as companies put up emmense barriers (especially the hosting companies), but I somehow got it to the minimum I can realistically have - which is roughly 60 I think. I try to avoid SSO, only exceptions are a single forum, which had broken registration, and my uni. Why? 1. SSO is a single point of failure, which you (unlike BW) cannot audit yourself; 2. You have to trust it's not gonna sell your data - perfect graph of services one person has is of course very juicy information; 3. They the make management of one's accounts slightly harder, as you cannot easily know how many you have by looking into your BW; 4. You are locked into your SSO service. For MFA, I use fido keys (yubikeys), which I have to highly, highly recommend. Not only are they miles ahead of anything else, but they are also so easy and quick to use. I have a little one permanently in my usb port and to log in you just touch it. I'd recommend this if you are MFA-fatigued. Obviously, I always take the best form of 2FA available regardless. All passwords in BW are long random alphanumeric and I have a XKCD-style password for that and something similar for FDE/logins into computers. BTW, getting BW was the best decision I could have made, not really for security (although that's obviously the point) but fkr convinience. No more silly variants on passwords and no more guessing emails for reset.
p2hari 3y ago
700 plus on Bitwarden. And a lot of Oauth with google and GitHub. 200 plus on Chrome personalised window. Around 100 on Samsung pass for apps that I don't have access on web.
menshiki 3y ago
Over 100 in my password manager. I use log in with Apple wherever possible. If a website does not matter and does not support Oauth with Apple, I will use Google.
ivolimmen 3y ago
I have 358 keys in my keepassxc. Loads of them are from a distant past; I never had the urge to clean them up. If I delete a password I also want the account to be deleted so that costs too much time... now at least I know who knows me... ?
carom 3y ago
295 items in 1Password.
nikisweeting 3y ago
1361 in 1Password, probably ~100 that I use at least once per year.
Daunk 3y ago
Currently at 307.
altacc 3y ago
About 500, after a clear up. I'm currently shopping around for a new password manager but that's proving to be a frustrating search. Bitwarden scrambled my master password so that I lost access, not just once but twice (password was saved in another password manager, so definitely correct). Lastpass has 'issues'. Dashlane web app only gives me an error message. 1Password feels clunky but may be what I end up going with. Needs to be usable & shareable by tech-averse spouse & children as well, so hosting my own isn't really an option.
- 2-718-281-828 3y ago
  look no further ... pwsafe.org
nathias 3y ago
imo the best way to handle this would be to have identities on browsers, and then have browsers automatically handle the logins without the user seening any passwords
rain1 3y ago
I feel like this isn't healthy for a human being
janosd 3y ago
Right now, 90-ish, but I used to have many more. Lately, I'm religiously deleting accounts (which I finally am able to, thanks to GDPR).
Exorus18 3y ago
2
EVa5I7bHFq9mnYK 3y ago
Hard to know, I have 20 to 30 Facebook accounts, mostly bought from account seller sites, becaused I wanted to see various Facebook pages not accessible to outsiders. Not sure how many of these passwords still work. My oldest working account is probably 1996's ICQ.
2-718-281-828 3y ago
611 entries in my password database (pwsafe.org)
nektro 3y ago
241 logins for me
npteljes 3y ago
I have 573 entries in my KeePassXC. I have several very important passwords that are not in there, like my work password and of course the keepass safe password. Auth is indeed insane. Because of this insane power, I don't trust any ID provider with my logins, not Google, nor any other third party, so I log in with a password everywhere. As for maintenance, I don't think it's much, and I'm not even using the browser integration (again, for security). It's a few simple clicks to create a new entry, and the default auto-fill (username, tab, password, enter) works on most of the websites.
whoami_nr 3y ago
I have 454 logins in the Bitwarden
hammyhavoc 3y ago
~15,000 after being online since the '90s. A lot of them won't work anymore, that much I'm certain of. A lot of things have come and gone in that time.
JohnFen 3y ago
I have 7, unless you include logins to the various systems and servers attached to my network. Then I have ~100.
i2cmaster 3y ago
1) Avoid making accounts in the first place. You almost never actually need one. 2) Recognize that for nearly all sites keeping your account secure is more their problem because they're trying to fight spam than it is your problem. I think I have about five logins that actually matter and the rest maybe they work or maybe I have to ask for a password reset/new account when I use the service.
synthc 3y ago
437, accumulated over 2 decades
butz 3y ago
Who knows, some idiot keeps using my email and signing up on various spammy services. Probably time to get a new email address.
SergeAx 3y ago
I have 967 entries in my KeePassXC database. That includes tons of now obsolete logins and passwords from previous jobs or/and defunct services. It doesn't bother me, and I dont want to spend days just to validate/clean up it.
nokya 3y ago
I see many people mentioning the number of passwords in their KeepassXC. I can't find the option for that. Where is it?
- 5e92cb50239222b 3y ago
  Ctrl+Shift+R (or Database → Database Reports)
mindwork 3y ago
376 items accumulated over 12 years using password manager and multiple cleanup runs. I think top for me was around 480. It was hard to find it in the new version of 1password

throwaway019254 3y ago

800 logins in my Bitwarden. These are logins I collected over the last 15 years. A lot of them are for pages that don’t event exist anymore.

SAI_Peregrinus 3y ago

751 entries in my KeePassXC database. I'm sure a number of those accounts are for long-dead sites, and many of the rest are throwaways I don't expect to use again.

sieabahlpark 3y ago

[dead]

simonjgreen 3y ago

1,742 according to my Bitwarden on Logins :grimace: Given my use of password managers goes back to pre 2000 I'm willing to bet a sizeable percentage of the sites don't even exist any more

ftxbro 3y ago

this is nuts, i was expecting people to say like 8

rasse 3y ago

800+ entries linked to 784 unique email addresses.

beaugunderson 3y ago

1Password tells me I have 4,182 items... and that's probably not even everything.

ddp 3y ago

1112+, plus 25 in Microsoft Authenticator w/ cloud backup enabled, and a Yubikey 5c FIPS for every device I care about.

skyzyx 3y ago

Over 900.

davidblue 3y ago

Definitely a relevant topic, I'd say, especially if the discussion help any stragglers over the "edge" into finally using a password manager. (As far as I'm concerned, it is absolutely a requisite for all digital citizens in 2023.) ((And kinda has been for 10+ years but ya know.)) I'm closing in on 5000 credentials in 1Password, personally, but my collected vaults/database is 15+ years old now and definitely has [problematic duplicates](https://github.com/1Password/solutions/issues/1 https://github.com/1Password/solutions/issues/1). After a lengthy-enough sample of semi-formal self-observation, I'm averaging: - signing in/authenticating 10 times/day (including weekends,) and most of those are repeats with the same service. - Almost 10 new accounts/credentials per week. (Granted, I'm pretty darn indiscriminate about doing so while exploring.) Without tangenting too far, if anyone has any advice about how to constructively normalize password management (even just as an abstract) for end users - whatever that may mean - I'd love to hear it.

rollopack 3y ago

In Firefox's about:logins I have 1333 saved credentials

kdne_jdnf 3y ago

About 500-600 items

LorenDB 3y ago

I have 93 personal accounts in my Bitwarden, plus 13 that I have categorized as "deprecated". I don't think 176 is wildly unusual; it may be a bit higher than some people, but it's certainly not a Guinness World Record or anything like that.

bombcar 3y ago

The elites don’t want you to know this but the accounts on the Internet are free you can take them home I have 458 accounts.

Onavo 3y ago
[flagged]
- dang 3y ago
  Can you please not post unsubstantive comments or political flamebait (or other flamebait) to HN? You've already done it repeatedly with this account. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
belter 3y ago
Every time you "log-in", you're increasing your carbon footprint :-)
- bombcar 3y ago
  Most of the logins are sequestered in the password manager, for which I get a moderately decent subsidy from the government.

c17r 3y ago

According to Bitwarden, 479 accounts

distances 3y ago
Hehe exactly the same number I have in KeePassXC, 479. I'm pretty sure many of these services have shut down years ago.

1827163 3y ago

182 logins here, although most of them aren't used frequently.

escapedmoose 3y ago

326

davidn20 3y ago

515 - thank you Jesus for password managers

aed 3y ago

Interesting question! I just checked and, wow, I have 922 accounts in 1password. (From 10+ years of use.) It’s funny you bring this up because I’ve thought about “cleaning up” 1password before. But all the extra accounts are not really in my way. I never use oauth (like to create a new account / password for everything). All of my work-related accounts are in there from several employers. Lots of passwords for (probably dead) servers. I count 28 logins for salesforce.com from past employers, various sandboxes, and consulting gigs.

kylehotchkiss 3y ago
The archive feature is nice for cleanup. It doesn’t delete, just hides from lists and searches. I’ve un-archived many items before.
ryan29 3y ago
> I never use oauth (like to create a new account / password for everything). Me too. I have 672. Lots are for accounts I set up for nieces/nephews, etc., so those don’t really count. I bet 100 are stale as well I’ll clean them up one day. Lol.

suddenclarity 3y ago

Slightly below 2000 last time I looked. Most sites don't support deleting content or accounts. In best case they just "anonymize" you. So it just keeps growing...

neon_electro 3y ago

1,226 items in my 1Password database. Very happy customer.

insomniacity 3y ago

So if anything with OAuth is tied to Google, how would you survive losing your Google account?

firecall 3y ago
For this reason I stopped using Google / OAuth a couple of years back!

drakonka 3y ago

I currently have 344 accounts in my password manager.

KomoD 3y ago

939 accounts in 1PW

BaudouinVH 3y ago

https://i.imgur.com/QHMavTm.png https://i.imgur.com/QHMavTm.png 1078 - many I of them I've used once

gepiti 3y ago

Only 375.

achairapart 3y ago

I really don't know how many accounts I have, for most of them I don't even store passwords, I just generate them in a deterministic way with a little password generator I made[0]. Some time ago I realized what a waste was to store so many secrets, even more knowing that for the most part I'll probably never need them again. For the - proportionally few - important secrets, I use (and really like) Pass[1]. [0]: https://aprico.org https://aprico.org [1]: https://www.passwordstore.org/ https://www.passwordstore.org/

gnrlst 3y ago
Aprico is a neat idea, but as soon as you face a website that has stupid requirements like a character limit, specific banned characters (like symbols), or other it has no way of adjusting for that and you have to start tracking exceptions. It also has a 1-1 limit of website, unless you come up with service naming heuristic as well. Regardless of these limitations (which I realize are edge cases and very much not the point of the service), it's a nice, simple idea :)
- xp84 3y ago
  Don’t forget the even stupider variant, the allow-list of like 5 symbols. “Tell me you failed infosec 101 without telling me you failed infosec 101.”
  - NegativeK 3y ago
    There's a local government website that requires eight or fewer characters, and the eighth character has to be a digit. They've tried to change the requirement, but it comes from vendor software. The vendor just waves around a middle finger and points to the contract.
- achairapart 3y ago
  Anectodal from a few years of use, surprisingly those stupid requirements are almost a thing of the past nowadays. But yes, some edge cases still require some bits of muscle memory, which may be your thing, or not. I'm a bit ashamed that I never found the time to write down some docs, so I never really shared it, apart from a few friends and colleagues. On desktop, the web extension is quite convenient, it will autofill everything for you but the master password. On iOS, I made a simple shortcut[0] where you share a url and - thanks to the os autofill - you just get your password copied into the clipboard, no input required at all. Also, on Android there is something similar using the PWA Web Share Target API. And that's it, thanks for your kind words. [0]: https://www.icloud.com/shortcuts/2dcb6680e6b3424d8708e673e1af67e5 https://www.icloud.com/shortcuts/2dcb6680e6b3424d8708e673e1a...

gnrlst 3y ago

600+

manuelmoreale 3y ago

410 according to 1 Password. I do periodic cleanups though and I should probably do one soon so the number of actual, in use, logins is probably lower.

alxjsn 3y ago

633

marssaxman 3y ago

There are 92 entries in my credentials archive. I try to avoid creating them if at all possible, and I never use OAuth.

karmakaze 3y ago

> But I still have a near-stroke every time I have to do the "forgot my password" loop, or use Duo Mobile/other 2FA. That's funny, I've stopped caring about remembering most passwords and use the "forgot my password" loop as a login mechanism for rarely accessed sites/services. I also only enable 2FA on important ones like email, github, or banking. Basically my threat model includes my ability to lose things.

pacifika 3y ago
This works until you want to change your email domain (or provider in some cases)

deathtrader666 3y ago

1300 as per 1Password.. and must be 500+ in my old Firefox account that I didn't bother exporting.

AH4oFVbPT4f8 3y ago

1322 currently in Bitwarden

KronisLV 3y ago

Around 300 at this point, sans any deleted ones. I don't think I know a single password anymore, since they're all randomized and separate for each site. > Obviously, anything with OAuth is "bundled" into my Google account. Maybe it's just me, but I try to never use centralized identity providers (outside of things that I really don't care about) and use separate e-mail auth whenever possible, across multiple e-mail accounts (some self-hosted). Same with considering separate Google accounts for phones, services like e-mail, a separate one for any content creation on YouTube and so on (ideally without any of them coming in contact with one another). The idea is that one account getting closed/suspended shouldn't result in ALL of the linked stuff becoming inaccessible. I don't even do anything weird online, it's just that nowadays you hear lots of stories about people getting banned based on some heuristics by automated systems, with no ways of getting in contact with the support. Even something like a VPN might trip those systems up. Similar things have happened to me before (a SaaS provider didn't want to do business with me) for no good reason even without a VPN, but trying a year later with the same credit card didn't result in the other account being auto-suspended. How odd. I guess the next step would be to have usernames, phone numbers and even payment methods (apparently virtual credit cards sometimes work) also be more randomized and more compartmentalized, though something tells me it'd be a pain to do that. That said, I largely believe that privacy online is mostly dead due to how much fingerprinting there is, though one can still protect themselves from automated systems acting weird, because nobody genuinely cares about that, at least at the scale where they're needed.

Froedlich 3y ago
I have about 150 accounts, though some of them are logins for vendors I dealt with once, a decade or more ago. > I guess the next step would be to have usernames, phone numbers and even payment methods (apparently virtual credit cards sometimes work) also be more randomized and more compartmentalized, though something tells me it'd be a pain to do that. --- I do that. It's no trouble. I use various usernames to 'fuzz' tracking. Yes, anyone who really cared could track me by my IP address, but trackers are like whales sieving krill; they get so much, they don't bother to look very hard.
xp84 3y ago
> people getting banned … with no ways of getting in contact with the support This is the most out-of-whack part in my humble opinion. Most of us have a tremendous amount of data and things like auth tokens tied up in Google, and Apple, and due to their scale and the fact that at least for GOOG it’s a “free service,” they’ve set the expectation up that “support” should be limited to searching an FAQ, and also that any account they ban must be some kind of troll account that shouldn’t be listened to. God forbid they give you a phone number where you could bother a person until your problem was solved. Using ad-supported services for vital stuff is risky. But I know even Apple isn’t very helpful, even for those of their iCloud users who pay.

ChoGGi 3y ago

> Obviously, anything with OAuth is "bundled" into my Google account. So if anything this is a huge underestimate. If Google ever pulls the plug on you, you're in for a bad time.

xp84 3y ago
I guess despite how cool it is to hate Facebook in 2023 there’s a really solid case to be made that it’s a smarter “OAuth” choice than Google, since with Google, if you fell back to resetting your password for another site to get in after a Google account shutdown, the email on the account would be the same Gmail account that you’re locked out of!

Brajeshwar 3y ago

3,995 by 1Password as of May 21, 2023.

Semaphor 3y ago

Over 500, though I have no idea how many of them still exist. I use a password manager and unique email addresses, why would I care how many accounts I have?

hotpotamus 3y ago
What are you using for unique email accounts? DIY or some service?
- Semaphor 3y ago
  DIY on fastmail with custom domain.

aranke 3y ago

203 according to 1password, but I archive the ones I don't need roughly every year.

web3-is-a-scam 3y ago

Hundreds. I’ve lost count they’re all in 1Password.

MacsHeadroom 3y ago

About 1,400 in KeePass. Perhaps a poll would with ranges would have been better. 0-100 101-300 301-800 801-1200 1200+

jeanlucas 3y ago
Indeed, although it would not be that hard to parse all replies and plot it.

deleted 3y ago

[deleted]

arisAlexis 3y ago

You mean since I started using the internet in 1995? Or only live ones

dt3ft 3y ago

What is bitwarden doing to help lower the number of accounts, exactly? I'm out of the loop.

NegativeK 3y ago
Bitwarden lowers the mental burden for secure (which includes unique) passwords, precisely because we have a crap ton of accounts.

plantroon 3y ago

I have 728. Before Bitwarden I used password store. I migrated with a script about 2 years ago, and I still don't have all the necessary metadata in at least a half (meaning there is no icon, usernames are messy, etc). I only update the old entries whenever the accounts are needed, meaning that I haven't used half of them in 2 years. So I "actively" use about 360 accounts on various services.

ctoth 3y ago

Exactly 256 in Keepass currently.

freitasm 3y ago

I have 872 according to BitWarden: https://cdn.geekzone.co.nz/imagessubs/3c01663b43a16e0b50577a8d1d95f368.jpg https://cdn.geekzone.co.nz/imagessubs/3c01663b43a16e0b50577a... I don't use OAuth, except for two services - which I could switch to user/pass if I really wanted.

bastijn 3y ago

My password manager says 407 currently in my vault. I only use social login for very very limited amount of sites. My default option is to create app/site specific accounts so I can append my email with +sitename to see who leaks my data.

SoftTalker 3y ago

A bit under 200, but only around 20 that I use with any regularity.

jeroenhd 3y ago

Bitwarden lists 791. A ton of them are for internal services/local dev accounts/what have you, but that's still a pretty long list. I don't use most of them. A third of them are for my spam email address. I'm starting to notice Bitwarden taking its sweet time decrypting them all, though.

morkalork 3y ago

Shit, just looking at the replies, there's a solid case for password managers. No normal human is going to memorize 100+ unique passwords meeting various complexity requirements. It almost makes shaming people for re-using passwords look like you're out of touch. Of course they're following bad practices, how could they not be?!

pugworthy 3y ago
Or a solid case for alternatives to standard username / password login concepts.
causality0 3y ago
I take a pragmatic approach: the dozen logins in my life that actually matter get strong unique passwords, and everything I don't give a shit about gets the same password.
- Misdicorl 3y ago
  I take the same approach with the extra precaution that those logins also get a separate email address (with a different pseudo-strong password). Makes it really easy to share nonsense logins with my wife/family.
- lwhi 3y ago
  It's not pragmatic, it's dangerous. Sooner or later someone could take control of one of the accounts you don't care about and use in a way you don't expect to gain control of things you do care about.
  - Dalewyn 3y ago
    Beyond my accounts related to my important email addresses, Steam, finances and medical which can all be counted on one or two hands, I really couldn't give a damn about the other accounts or their password security. Strong and unique passwords for the important accounts, simple and reused passwords for the rest. You're welcome to hack into my accounts on Hacker News, Reddit, Discord, LINE, various IRC networks, various forums, etc. I don't care; there's nothing important in there besides sentimental value.

tananaev 3y ago

963 in Bitwarden

colinmegill 3y ago

241 in 1password 340 in Google Password Manager

akira2501 3y ago

If I need to login to your site less than once or twice a year, "Forgot my password" is my password manager. Personally, I feel that the utility of me working to keep and maintain that information in a database for high availability is essentially zero. As a result, I store very few accounts overall and checking out as "guest" hasn't been a problem of any sort. There's like 10 critical things that I feel the need to store the password on and they all use a hardware key for 2fa anyways. For the two accounts that I absolutely can't lose access to, I just used the "Correct Horse Battery Staple" method and came up with two very long and secure passwords that I have no trouble remembering.

rhn_mk1 3y ago
A password manager is not just a way to manage passwords. It's also a way to manage who holds your personal data, so you can GDPR request them to stop.
- kdklol 3y ago
  This. It's so valuable just to know how exposed you may be. I know a guy who missed a data leak and later got one of his accounts stolen. I think his Steam? It was way back in the day... For him, it was a cheap reminder to take passwords hygiene seriously. For someone else, it could have been a someone-took-out-a-line-of-credit-in-my-name reminder.
jay_kyburz 3y ago
Yeah, I'm the same. Google and a few others. The rest all just get the new password that Firefox suggests and I don't even pay attention to what it is.
cheeze 3y ago
I just use a crappy password. It's been leaked before. I don't care. If someone wants to take over my last.fm account that I haven't used in 3 years, sure go for it. The important accounts get a randomly generated password stored in my password manager. And the really important accounts only have half the password saved, I manually fill in the other half.

tgv 3y ago

360 for websites (most of which I've only used once; the oldest are dated 2011, but those are probably import dates, as they all have the same timestamp), and 100 or so for more serious stuff (banking, routers, etc.) in KeePassXC.

jeanlucas 3y ago

952, I store accounts user and passwords that I have since 2011, and I like to try new services. Especially to give feedback to makers.

daneel_w 3y ago

My keychain has 54 items in it. I think at least 5 of them belong to things I've shut down.

sigio 3y ago

about 750 in my personal 'pass' store, and about a 1000 in the shared password store for work. Bitwarden probably has a significant subset, but I prefer to keep 'pass' as authoritative source.

hhh 3y ago

600 in Chrome. 800 in iCloud Keychain. I assume there's a % of duplication between the two, since I don't really use Chrome anymore outside of Windows.

varenc 3y ago

1259 on 1Password! https://dl.dropboxusercontent.com/s/4ug9qyk67z9pkml/Screen%20Shot%202023-05-21%20at%2010.39.51%20AM.png https://dl.dropboxusercontent.com/s/4ug9qyk67z9pkml/Screen%2... Still using 1Password 7 and its self-hosted vaults with the 1Password app denied all network access. This is good reminder that I should login to all my old Google accounts to keep them from being deleted since Google is finally making moves to erase accounts unused for over 2 years. (especially given how it's always getting more difficult to create new G accounts)

nickjj 3y ago

$ pass | wc -l 321 17 of those are encrypted notes (API tokens, license keys, etc.). `pass` is a command line password manager: https://www.passwordstore.org/ https://www.passwordstore.org/

zikduruqe 3y ago
$ pass |wc -l 176 Was hoping to be the only cool kid posting pass counts... :)
aendruk 3y ago
$ gopass list --flat | wc --lines 575
sirodoht 3y ago
I love pass! $ pass|wc -l 1252
philsnow 3y ago
% bw list items | jq length 494 I used pass for years, but eventually quit when needing to rekey the gpg stuff for the fifth time and it being a pain to provision another key for passforios. It looks like there's some work to let pass use age for crypto instead of gpg, but I don't know if that's been ported to passforios or any of the other pass-compatible mobile apps. Pass using git as its storage backend doesn't make a whole ton of sense for me. It's convenient enough for syncing if you use a public git host, but it's got a lot of unnecessary power. More than a few times I had to merge by hand when I had changes from both my laptop and my phone. I use vaultwarden these days and it's pretty great. I wrote a (gross, ugly, but that's fine because I used it exactly once) thing to migrate from pass to bitwarden/vaultwarden, https://github.com/philsnow/pass-to-bitwarden https://github.com/philsnow/pass-to-bitwarden edit: forgot to mention, if you don't care about using Bitwarden the company for hosting, they have a somewhat generous free-forever tier https://bitwarden.com/pricing/ https://bitwarden.com/pricing/

browningstreet 3y ago

944 items in 1Password (fingerprint me!) I'd have more but even 1Password doesn't always catch when I'm creating an account login, or resetting a password, etc. I do the work to input some of them, but not always (I get lazy). I do try a lot of tools, and I have a lot of personal and professional GMail OATH logins too, which -- fortunately -- 1Password now tracks.

nyadesu 3y ago

319, currently using Bitwarden to manage them and been pretty happy with it so far

aaronax 3y ago

I would not expect any true innovation to come from companies such as 1Password or Bitwarden. They make money off authentication being so craapy that an entire class of applications has sprung up around it. They will not innovate themselves out of existence.

lorenzk 3y ago

809 in Bitwarden. Collected and migrated over the years from lastpass to enpass to bitwarden.

zimpenfish 3y ago

1456 items in Bitwarden; 1180 have both username and password but there's a lot of duplication - e.g. I've got 6 items for my local nzbget instance (all the same u/p combo.) This is an accumulation since ~2010 starting with 1Password, then LastPass, then Bitwarden. [edit: 1339 items have a password but only 1180 of those also have a username]

lukevp 3y ago
Do you know you can add multiple URLs to the same un/pw and it will autofill on more sites?

crooked-v 3y ago

The most infuriating auth-related thing for me is the companies that insist on doing phone-based 2FA. I'm inextricably linked to my specific phone number at this point in a way that previously was only an issue with my email address.

willtemperley 3y ago
This. SMS 2FA has been considered insecure by NIST since 2016 [1] and it's a major pain when travelling and swapping sim cards. [1] https://www.theregister.com/2016/07/24/nist_says_sms_no_good_for_authentication https://www.theregister.com/2016/07/24/nist_says_sms_no_good...
- tornato7 3y ago
  The best solution is to create a Google Voice account and use that number for 2FA
  - rtsil 3y ago
    Until Google decides to retire Google Voice...
  - NoZebra120vClip 3y ago
    Many MFA implementations will detect and disallow the use of VoIP numbers... for security reasons.
    - twodave 3y ago
      Yep, and this is because sim-jacking is actually less profitable than just finding records of people’s _past_ phone numbers and signing up for a voip service that supports sms for that number. And many of the voip providers just don’t do any kind of fraud prevention. Source: I work at a place that is a natural target for this kind of thing.
- Biganon 3y ago
  I was thinking this with my health insurance website (which uses SMS 2FA), and I realized the problem is you can't expect your average Joe to know how to manage a TOTP 2FA correctly. SMS might not be the most secure, but it's probably better than 1FA, and absolutely everyone can use it. Enter your number, receive text, boom.

uguuo_o 3y ago

Personal ~10 Work related maybe ~20

jimnotgym 3y ago

Around 1,000 in 1password. I use 1password because many of them are shared. Edit. That is only my work 1pass. I have a personal instance too with a few hundred.

pimlottc 3y ago
I'm curious, do you actually have ~1,000 work-related accounts? Or second accounts/alts for various non-work sites using your work email?
- jimnotgym 3y ago
  I have zero non-work sites on my work email. Crazy isn't it. Not everything is a login, and not everything is a password. There are keys in there for instance, and some credit cards. The majority are logins though. Crazy, isn't it.

gjsman-1000 3y ago

And I thought I was out of hand with 496 in 1Password… now it feels quaint looking around here.

smcleod 3y ago

Looks like I have 2160 in Strongbox (recently moved from 1Password).

bin_bash 3y ago

176 sounded so low to me I wasn’t sure if you were talking about for all sites or just HN alts.

_benj 3y ago

Before posting I was looking at the comments to see how bad I was… after seeing 1k+ it seems like I’m fine with my 627 bitwarden items!

moltar 3y ago

1000s

thr0waway001 3y ago

Personal ones close to that. But as a contractor, way more than than 176.

efitz 3y ago

I have 921 items in 1Password; most of them are logins.

mfontani 3y ago

380+ logins on bitwarden 45+ 2FA on Authy 2 yubikeys It gets... pretty confusing, especially as I've not checked the gopass repo, where I keep _other_ stuff, too...

rtsil 3y ago

1105 according to Keepass. Although at least a third of these are no longer active.

johnorourke 3y ago
woop another Keepass user!

whstl 3y ago

I'm probably the one with the least. I have 35 in my password manager. I purge the ones I don't need every 2 or 3 months. I even gave away GOG and Steam accounts to friends after years of not playing games. Sometimes I have to send a threatening email to delete some accounts. Currently there's about 2 I'm waiting for an answer. It's gotten worse lately: people just don't delete your account anymore :D. Because of that, I use "hide my email" and put fake personal data pretty much everywhere now. When I REALLY don't care or am just checking the service, I use a burner email. I honestly wish I had close to zero. I really hate SaaS and I really hate websites that require a login for stupid stuff (like... a barbershop that needs login/password for scheduling haircuts? fuck off).

lexandstuff 3y ago
I'm confused about what you're fucking off. Would you prefer to schedule haircuts via a call or an anonymous online form? Being able to schedule appointments online is one of the big wins of modern life imo: it beats waiting around on hold and laboriously explaining to the receptionist how to spell my last name.
- rhn_mk1 3y ago
  There are things that work anonymously (or at least pseudonymously) already: pizza delivery or hotel booking. It's not like the data presented at a random registration form has to reflect your government ID. Skipping the login step just saves the hassle, and preserves the win of being able to do things online.
  - whstl 3y ago
    Exactly. Purchasing with a guest login works fine for most shops here. In this specific case I was talking about it's even worse: I already have to click a link in the email (or answer an SMS) to confirm the appointment. It's ludicrous.
- justsomehnguy 3y ago
  > Would you prefer to schedule haircuts via a call or an anonymous online form? Why the hell no? At worst "an anonymous form" can ask for your mobile number only to remind you about the appointment (if it's not today for example). At best it should be really optional. In both cases there is absolutely zero need for both a login and a password. I have a local pizza joint working like that - you just punch in what you need, your number with SMS code confirmation and you are in, with your address/es and pizza coins or whatever. And they have your number to contact you if anything is wrong with the order/delivery. Another one just asks for a number and call back to confirm with an operator. Why the hell I do need a login, a password and email|Facebook|whatever for a pizza delivery?

johnorourke 3y ago

Why keep score? If you have a password manager, the number is irrelevant. But: KeePass 2052. Cheating because I work for an agency... so we have hundreds of clients' passwords to store and selectively distribute to the team.

psychphysic 3y ago
Agreed. This is utterly baffling question. You might as well ask me how many grains there are in my salt shaker. Interesting academic question, but seeing so many people climb on their soap box is wild.
- 93po 3y ago
  i don't find it to be a baffling question. i think the unspoken part of this is "this is a really stupid system, someone ought to do something about it". i hope in the next 20 years that password managers are a thing of the past, but for good privacy-preserving reasons.
  - pishpash 3y ago
    Wasn't the passkey article just front page the other day?

frompdx 3y ago

I have 260 items in my vault. Of course, I'm sure it could use some tidying up.

huimang 3y ago

445 logins for me on a self hosted bitwarden (vaultwarden) instance. Although a lot of those are for user & root logins to local machines I provision.

thom 3y ago

940 in 1Password (I feel a lightweight that I haven't hit 4 figures yet). Stopped fighting a while back and signed up to the cloud version instead of just having Dropbox backups, partly to help onboard my family better. Haven't regretted it yet, obviously will do if/when I find out all my stuff has been hacked but blah. Don't have numbers for my work machine upstairs, but on my phone here's how recently they were all used: 1 Day: 1 2 Days: 1 14 Days: 3 30 Days: 3 60 Days: 8 90 Days: 6 So, mostly cruft. I have a lot of stuff still done via Google auth, despite migrating all my domains and email to Fastmail couple of years back (which has been flawless since). Also, just checked, and I only have 27 entries in Authy.

StopHammoTime 3y ago

636, and I lost a lot of them about 9 years ago. I’m honestly surprised I’m not over 750.

deleted 3y ago

[deleted]

snihalani 3y ago

1072

pps 3y ago

467, says my Bitwarden :)

tkuraku 3y ago

241 logins in kepassxc

extesy 3y ago

2151 according to Bitwarden. That's what 25 years of actively using internet does to you :)

shmde 3y ago
2151 is insane. Share any fun/quirky/useful uncommon websites ?

pt_PT_guy 3y ago

886 according to keepassxc

donaldihunter 3y ago

1Password says 348 for me, and I know there's many more that are autogenerated and stored in a keychain.

retrobox 3y ago

More than 1000. More than I'd like. I can't help but wonder how many websites my personal information is on at this point between random shopping, forums, and all the rest.

tasuki 3y ago

206 Not counting all the sites for which I use the "Log in with Google/Facebook/etc". Many of these credentials I haven't used for years.

blitzar 3y ago

746 accounts. 746 unique passwords, ~600 unique usernames, ~600 unique email addresses.

tzhenghao 3y ago

I have over 300 on 1Password, some with more than 5 different accounts from the same site like Google and Slack. I also lean heavily on the 1Password extensions to help on the retrieval part. It's incredibly insane but I manage it by adding a namespace postfix so it's easier to identify which when autocompleting login forms. For example, "Google (Personal), "Google (UMich)" etc.

jonathantf2 3y ago

1Password currently has me at 476 logins, I assume some of those are duplicate accounts or burners.

a10c 3y ago
593 for me in 1Password

purplecats 3y ago

1,101

snailmailman 3y ago

Over 300 in a self-hosted vaultwarden. I’ve got my vault password memorized but that’s about it. All 300+ are secure randomly generated ones that I do not know. And I’ve got 2FA stored there too. Despite the huge number of accounts, logging into anything is seamless across any of my devices. And access to my vaultwarden is securely protected. Password managers are great. Really looking forward to vaultwarden eventually storing Passkeys as well, and using passkeys to login instead.

an_ko 3y ago
What's the point of 2FA if you store it in the same place as the first auth factor? Or maybe I've misunderstood. Are they behind different master passwords or something?
- kombustor 3y ago
  As far as I understand it: The password is the "thing you know" and the password manager file is the "thing you have". So if someone compromised your email account knowing your password, they still need to access your password manager file to get access to the 2FA codes. So it's still a second factor in that sense.
- snailmailman 3y ago
  If an individual account password leaks, the second factor still protects the account. This primarily only protects against leaked passwords from the site being hacked. Not from vaultwarden being hacked. But if my vaultwarden gets hacked I’m done anyway. They will had to have used multiple factors to get into the vaultwarden anyway. Quick edit: I’ve also got all the codes in an actual Authenticator app on my phone (so I can get into vaultwarden if I have to) But they are additionally in vaultwarden for convenience. When vaultwarden autofills, it copies the code to my clipboard and I can seamlessly pass the second factor check. Either way, access to the codes needs physical access to a device I’m already on. In practice I’m only ever logged into vaultwarden on my phone and my PC, although I could login remotely if I had to. As an additional safety measure, when my vault is logged into some monitoring software sends me a push notification through an external service.

michaelmior 3y ago

Bitwarden lists 1,601 for me. That's not counting sites that use Google, GitHub, et al. for auth which I will often choose if offered.

adontz 3y ago

183 after some recent cleanup

gzer0 3y ago

I have over 4,000 This is because I rotate accounts frequently (well, besides here).

quicklime 3y ago

312 entries, although only 37 were accessed in the last 12 months.

irrational 3y ago

According to bitwarden, I have 363. Though, I have more than that that are not stored in bitwarden. Some of them are my work accounts, others are ones I created while on mobile where it is a pain to add them to bitwarden. The real number is closer to 400.

12907835202 3y ago

I have over a thousand and hundreds of warning about compromised passwords. Annoyingly they're all for forums I was part of as a teenager 15-20 years ago with a dead email address referencing pink monkeys. I just never get round to cleaning it up.

Tempest1981 3y ago

I created a HN poll: (Underutilized feature) https://news.ycombinator.com/item?id=36025420 https://news.ycombinator.com/item?id=36025420 Sorry about the (lack of) order. Looks like it's randomized? (feature)

gigel82 3y ago

284; that's with actively trying to purge the list every 3-6 months (sometimes just an online form but for more obscure / smaller sites, it's a couple of weeks and chains of emails back and forth).

YourDadVPN 3y ago

Roughly 350, all with unique passwords and mostly with unique email addresses too. They're categorised, and the only categories with more than about 20 entries are catch-alls I never look at anyway. It's pretty useful and sometimes interesting to go on a website and find out I made an account there two years ago.

spiffytech 3y ago

My Bitwarden says 1,703. I'm surprised to see so many people with low hundreds.

metaltyphoon 3y ago

bikingbismuth 3y ago

Checking 1Password, I have 283. If I include sites I keep only in my brain that is probably a touch above 300.

ioman 3y ago

Went and checked my 1Password. Apparently, I have nearly 1,800! My oldest remaining password was created in 2010, so I've been using it for a while.

Havoc 3y ago

Maybe 200ish or so Loads of old crap though. Will clean it out next time I'm migrating passwd managers. Probably 50-ish that actually matter

aendruk 3y ago

With a version controlled password store you can do silly things like this: $ gource … ~/.password-store | ffmpeg … password-store.mp4 $ publish password-store.mp4 QmeN62Ewuv93epe27VmniXHUFJQLirFfEo5eM1sKdxd2m5 https://cloudflare-ipfs.com/ipfs/QmeN62Ewuv93epe27VmniXHUFJQLirFfEo5eM1sKdxd2m5 https://cloudflare-ipfs.com/ipfs/QmeN62Ewuv93epe27VmniXHUFJQ...

mock-possum 3y ago
well that's fun

narag 3y ago

About 200, but no more than 30 are used often and maybe 5 are important. I don't want to tell how I store them, but for these 5, I could even memorize them.

michaelsalim 3y ago

531 in my bitwarden storage. I don't create an account unless absolutely necessary. So the number is higher than I thought. I guess most of it is likely work related. I cycle through many projects. Each of them have many accounts tied to them. Eg: DNS, domain, hosting, etc etc. Not to mention all the business systems like HR.

lucb1e 3y ago

808 in my password manager, plus a few in my head (stuff like bank logins and the pwd manager's password) or cold storage (no e-money, but e.g. the manager's password and passwords to unlock system backups).

LeonB 3y ago

Over 1000 entries in my password Tracker.

lytedev 3y ago

$ pwd && fd --type file | count /home/daniel/.home/.password-store 512 Need some cleanup I supposed...

brickfaced 3y ago

KeePass says 305. That's a few decades' worth of logins across everything from Yahoo! to GMail to random online storefronts. Unique password for each. Doesn't include old accounts I've deleted where possible. Not all services offer account deletion, sadly. When I can't delete an account I leave it with blank or garbage contact info and link it to a one-off email alias for spam prevention.

ajdude 3y ago

My keepass says 484, but I have a feeling there's duplicates. I really need to curate these better.

rout39574 3y ago
Hah! Password count cousins! I'm 484 in lastpass.

bigburner 3y ago

Where I work 'Single Sign On' doesn't live up to its name; many of us spend the first 5 minutes of each day signing into things, waiting for the 2FA code, entering it, then rinse and repeating for a half-dozen apps.

sashk 3y ago

I have almost 1900 items in my password manager: this includes logins, software licenses, notes, etc. But this does not include items in vault Attic, where I move items which are no longer exist (dead sites, deleted accounts, old ids, etc).

bingohbangoh 3y ago

335

verandaguy 3y ago

I'm pushing 600 in my main password manager, but most of them aren't unique — I just use "farce72$" by default since it hasn't shown up in HIBP (yet -- fingers crossed) and hits three of the major character classes, so it's pretty high-entropy. The password manager mostly serves the role of autofilling stuff in browsers.

BLKNSLVR 3y ago
In case anyone's wondering, it's not the HN password (with or without quotes) :)
- verandaguy 3y ago
  I wondered if anyone would try that :)

GabeIsko 3y ago

It's a good day if I can get through it without creating an account.

dot5xdev 3y ago

270 login credentials work+personal. I don't use 'sign in with Google'. I regularly try (not always successfully) to go through my 1Password vault and delete accounts that I haven't used in a while. (I wish 1Password let you order credentials by "last used". This way I could start deleting from the oldest last used accounts.) I wish I had less accounts because each account means some random website holding my data hostage. It's too common that a website doesn't allow you to delete an account. Sometimes you can find a support email and request a deletion. Other times, all I can do is try to replace my data with junk data. Although, even that isn't possible sometimes! (Rocketbook won't let you change your email, for example. Or ChatGPT saves your phone number after you delete your account.)

gaurangagg 3y ago

Earlier I used to maintain the passwords in an Excel and the life in a way changed when I discovered Password Manager KeePassXC - which is amazing. For my frequently accessed accounts, I also prefer Apple Keychain to login faster across the devices.

sevensevennine 3y ago

1Password deleted more of my accounts than that when it crashed the v8 upgrade. SK

8ytecoder 3y ago

1906 items in my 1Password. Not including those I archived or deleted.

imvictor 3y ago

https://imgur.com/G7RUsYf https://imgur.com/G7RUsYf I'm running around 838 accounts because why not? I have a unique password for each login since five years ago. I went from LastPass to 1Password and finally settled on self-hosted Bitwarden(Vaultwarden) a year ago.

smsm42 3y ago

1146 in Bitwarden. But a lot of them are old, and some accounts aren't in BW. > Obviously, anything with OAuth is "bundled" into my Google account. I too used to live dangerously. But then I took an arrow... sorry, wrong one... then I read too many stories about "Google locked my account and now my life is ruined" and stopped using Google auth with anything but the least important sites on which I wouldn't mind losing the login.

Fancy5189 3y ago

1249

INTPenis 3y ago

I have around 40 2fa codes alone, number of accounts I don't even care to count. find .password-store -type f | wc -l says 1248.

zainhoda 3y ago

373

clircle 3y ago

Presently I have 384 entries in KeepassXC, but it's not all online accounts. Sometimes I just put info in my keepass vault because I want to have easy access to it while I'm at my computer.

djha-skin 3y ago

The problem with this metric is that several of those accounts are defunct or no longer even in existence. It's much easier to add to my keypass than to delete from it

loeg 3y ago

Uh, looks like 1200. A few duplicates from LastPass or the LastPass -> 1Password migration many years ago, I forget.

aio2 3y ago

I'm not joking... I have 69 logins lol

magicjosh 3y ago

Anyone experimented with Sign in With Ethereum? Wallet based login and account management onchain.

zantsuken 3y ago

I've got about 307 on KeePassXC, with the oldest generated password from 2016. 307 includes stuff like security questions as well though, so the answer to "What is your mother's maiden name?" tends to be something along the lines of "f+2Tng+DO?X).`W/7*5IQ_"

ofalkaed 3y ago

HN and a few forums, bank, email/cloud, website (which is really just storage for ancient stuff I have mostly forgotten but occasionally have a use for) and that is about it. I use guest checkout when ever possible and if I buy from a site which does not offer it I just close my account as soon as I finish checking out. I never made the switch to password managers and the like. I have all of my passwords memorized.

wintorez 3y ago

364

abrkn 3y ago

1,413

petarb 3y ago

1955

aslilac 3y ago

238 according to 1Password. Every time I add a new one I feel a piece of my soul leave my body.

anonzzzies 3y ago

899 in Bitwarden and that is after cleaning and excludes ‘lazy’ accounts I logged into with google or facebook (those I generally don’t use or find important).

dotancohen 3y ago

My password manager has four digits of credentials stored. It dates back to when years began with the digit 1. Certainly _most_ of those are no longer in use, but maybe the time has come to see if Taco is still posting to Chips & Dips.

nikolay 3y ago

Between 3,000 and 4,000 (1Password no longer shows the count).

_8j50 3y ago

Please tell me you let chrome save and sync your passwords lol. Always a delight for pentesters and real attackers a like when people do that.

kdklol 3y ago

My BW stands at 52 logins right now, but it's not yet quite complete. I think I'm missing a couple banks. Over the last year or so however, I cancelled almost 100 accounts, ranging from obscure forums, trough hosting providers, to facebook. It was a herculian effort, as companies put up emmense barriers (especially the hosting companies), but I somehow got it to the minimum I can realistically have - which is roughly 60 I think. I try to avoid SSO, only exceptions are a single forum, which had broken registration, and my uni. Why? 1. SSO is a single point of failure, which you (unlike BW) cannot audit yourself; 2. You have to trust it's not gonna sell your data - perfect graph of services one person has is of course very juicy information; 3. They the make management of one's accounts slightly harder, as you cannot easily know how many you have by looking into your BW; 4. You are locked into your SSO service. For MFA, I use fido keys (yubikeys), which I have to highly, highly recommend. Not only are they miles ahead of anything else, but they are also so easy and quick to use. I have a little one permanently in my usb port and to log in you just touch it. I'd recommend this if you are MFA-fatigued. Obviously, I always take the best form of 2FA available regardless. All passwords in BW are long random alphanumeric and I have a XKCD-style password for that and something similar for FDE/logins into computers. BTW, getting BW was the best decision I could have made, not really for security (although that's obviously the point) but fkr convinience. No more silly variants on passwords and no more guessing emails for reset.

p2hari 3y ago

700 plus on Bitwarden. And a lot of Oauth with google and GitHub. 200 plus on Chrome personalised window. Around 100 on Samsung pass for apps that I don't have access on web.

menshiki 3y ago

Over 100 in my password manager. I use log in with Apple wherever possible. If a website does not matter and does not support Oauth with Apple, I will use Google.

ivolimmen 3y ago

I have 358 keys in my keepassxc. Loads of them are from a distant past; I never had the urge to clean them up. If I delete a password I also want the account to be deleted so that costs too much time... now at least I know who knows me... ?

carom 3y ago

295 items in 1Password.

nikisweeting 3y ago

1361 in 1Password, probably ~100 that I use at least once per year.

Daunk 3y ago

Currently at 307.

altacc 3y ago

About 500, after a clear up. I'm currently shopping around for a new password manager but that's proving to be a frustrating search. Bitwarden scrambled my master password so that I lost access, not just once but twice (password was saved in another password manager, so definitely correct). Lastpass has 'issues'. Dashlane web app only gives me an error message. 1Password feels clunky but may be what I end up going with. Needs to be usable & shareable by tech-averse spouse & children as well, so hosting my own isn't really an option.

2-718-281-828 3y ago
look no further ... pwsafe.org

nathias 3y ago

imo the best way to handle this would be to have identities on browsers, and then have browsers automatically handle the logins without the user seening any passwords

rain1 3y ago

I feel like this isn't healthy for a human being

janosd 3y ago

Right now, 90-ish, but I used to have many more. Lately, I'm religiously deleting accounts (which I finally am able to, thanks to GDPR).

Exorus18 3y ago

EVa5I7bHFq9mnYK 3y ago

Hard to know, I have 20 to 30 Facebook accounts, mostly bought from account seller sites, becaused I wanted to see various Facebook pages not accessible to outsiders. Not sure how many of these passwords still work. My oldest working account is probably 1996's ICQ.

2-718-281-828 3y ago

611 entries in my password database (pwsafe.org)

nektro 3y ago

241 logins for me

npteljes 3y ago

I have 573 entries in my KeePassXC. I have several very important passwords that are not in there, like my work password and of course the keepass safe password. Auth is indeed insane. Because of this insane power, I don't trust any ID provider with my logins, not Google, nor any other third party, so I log in with a password everywhere. As for maintenance, I don't think it's much, and I'm not even using the browser integration (again, for security). It's a few simple clicks to create a new entry, and the default auto-fill (username, tab, password, enter) works on most of the websites.

whoami_nr 3y ago

I have 454 logins in the Bitwarden

hammyhavoc 3y ago

~15,000 after being online since the '90s. A lot of them won't work anymore, that much I'm certain of. A lot of things have come and gone in that time.

JohnFen 3y ago

I have 7, unless you include logins to the various systems and servers attached to my network. Then I have ~100.

i2cmaster 3y ago

1) Avoid making accounts in the first place. You almost never actually need one. 2) Recognize that for nearly all sites keeping your account secure is more their problem because they're trying to fight spam than it is your problem. I think I have about five logins that actually matter and the rest maybe they work or maybe I have to ask for a password reset/new account when I use the service.

synthc 3y ago

437, accumulated over 2 decades

butz 3y ago

Who knows, some idiot keeps using my email and signing up on various spammy services. Probably time to get a new email address.

SergeAx 3y ago

I have 967 entries in my KeePassXC database. That includes tons of now obsolete logins and passwords from previous jobs or/and defunct services. It doesn't bother me, and I dont want to spend days just to validate/clean up it.

nokya 3y ago

I see many people mentioning the number of passwords in their KeepassXC. I can't find the option for that. Where is it?

5e92cb50239222b 3y ago
Ctrl+Shift+R (or Database → Database Reports)

mindwork 3y ago

376 items accumulated over 12 years using password manager and multiple cleanup runs. I think top for me was around 480. It was hard to find it in the new version of 1password