4 ms·

Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves. Obviously there's other

Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves. Obviously there's other choices for those who want more control over it but you can't go wrong with BW.

flangola7 3y ago
2FA in the same app as your password defeats the point doesn't it?
- cjcampbell 3y ago
  It’s not my preferred method because I want 2FA to save me if my device is compromised, but it does still add protection against traditional password attacks, credential stuffing, etc. It even adds a layer of phishing resistance, as long as the user doesn’t blindly jump to copy/paste when autofill fails.
  - flangola7 3y ago
    What is the phishing resistance it adds? Bitwarden auto copies TOTP to the clipboard.
    - cjcampbell 3y ago
      Depends on the password manager. 1Password will not autofill if the domain doesn’t match. It’s up to the user at that point to check the url before copy/pasting the code. My guess is that the average user would do that by reflex without a second thought.
- GoblinSlayer 3y ago
  2fa is mitigation for weak passwords. With a password manager you can use a strong password, and 2fa becomes redundant.
rkangel 3y ago
I am currently trialling Bitwarden. I have found that it's not that great at picking up that you are creating an account, offering to generate and then saving the result (using Firefox with Bitwarden extension). I am looking at the other options as they are reportedly better at that sort of thing. It's a shame though because Bitwarden is philosophically what I'm looking for.
- ethbr0 3y ago
  Think you might have missed a not in there, if I'm reading sentiment correctly. "...found that it's that great..."
  - rkangel 3y ago
    I did - edited to fix.
- kadoban 3y ago
  I noticed that as well, the fix for me is pretty easy: just create the account in bitwarder first and then autofill it in the actual account creation page. No extra work, and becomes habit quite quickly.
  - rkangel 3y ago
    This is fine on desktop. It's less great on mobile.
    - JoeyPriceless 3y ago
      I used to agree with this until I thought about the order in which to do it. The issue was that I'd open BitWarden manually to create credentials, rather than doing it during the autofill popup. Here's how I do it on iOS: 1. Select the password field and open BitWarden through the button above the keyboard. 2. The password list will be empty. Press the + to create new credentials. 3. Enter a username, generate a password and press save. 4. The list will now have a single entry. Press it to autofill.
IggleSniggle 3y ago
Notably, Bitwarden is also self-hostable, which, in combination with the good mobile clients, was enough to get me to switch to it from Keepass.
- remram 3y ago
  Vaultwarden is even easier to self-host, it's basically a single binary that uses a SQLite database: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden

flangola7 3y ago

2FA in the same app as your password defeats the point doesn't it?

cjcampbell 3y ago
It’s not my preferred method because I want 2FA to save me if my device is compromised, but it does still add protection against traditional password attacks, credential stuffing, etc. It even adds a layer of phishing resistance, as long as the user doesn’t blindly jump to copy/paste when autofill fails.
- flangola7 3y ago
  What is the phishing resistance it adds? Bitwarden auto copies TOTP to the clipboard.
  - cjcampbell 3y ago
    Depends on the password manager. 1Password will not autofill if the domain doesn’t match. It’s up to the user at that point to check the url before copy/pasting the code. My guess is that the average user would do that by reflex without a second thought.
GoblinSlayer 3y ago
2fa is mitigation for weak passwords. With a password manager you can use a strong password, and 2fa becomes redundant.

rkangel 3y ago

I am currently trialling Bitwarden. I have found that it's not that great at picking up that you are creating an account, offering to generate and then saving the result (using Firefox with Bitwarden extension). I am looking at the other options as they are reportedly better at that sort of thing. It's a shame though because Bitwarden is philosophically what I'm looking for.

ethbr0 3y ago
Think you might have missed a not in there, if I'm reading sentiment correctly. "...found that it's that great..."
- rkangel 3y ago
  I did - edited to fix.
kadoban 3y ago
I noticed that as well, the fix for me is pretty easy: just create the account in bitwarder first and then autofill it in the actual account creation page. No extra work, and becomes habit quite quickly.
- rkangel 3y ago
  This is fine on desktop. It's less great on mobile.
  - JoeyPriceless 3y ago
    I used to agree with this until I thought about the order in which to do it. The issue was that I'd open BitWarden manually to create credentials, rather than doing it during the autofill popup. Here's how I do it on iOS: 1. Select the password field and open BitWarden through the button above the keyboard. 2. The password list will be empty. Press the + to create new credentials. 3. Enter a username, generate a password and press save. 4. The list will now have a single entry. Press it to autofill.

IggleSniggle 3y ago

Notably, Bitwarden is also self-hostable, which, in combination with the good mobile clients, was enough to get me to switch to it from Keepass.

remram 3y ago
Vaultwarden is even easier to self-host, it's basically a single binary that uses a SQLite database: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden