4 ms·

is it a good idea to use password managers built into web browsers? (vs using a password manager from some third party? bw/1p)

gchamonlive 3y ago
I don't think so, but since browsers offer this option it should be extremely stable.
the_pwner224 3y ago
I used Firefox's password manager for a long time but eventually switched to KeePass which is FOSS and not cloud based. It's much better than the browser builtin password managers. I store the .kdbx file in Syncthing (== Dropbox) so it automagically syncs between all my computers and phones. Use the KeepassXC app on computers along with their browser plugins, and the KeepassDX app on Android (idk about iOS). One advantage of this is that the passwords work across all browsers. If you use FF's password manager, you only get passwords available in Firefox; but with Keepass they work in FF & Chrome & for native android apps & etc. And with the browser plugins it works about as well as the browser's native password managers. It also has support for TOTP 2 factor authentication. Also I can easily make a copy of the .kdbx file (literally just ctrl-c ctrl-v the file) to save archives of my password db. (That said, over years of having the database open across multiple devices and editing it while open on multiple devices, it's never gotten corrupted)
- ddhhyy 3y ago
  Similar workflow here. On iOS I use Keepassium, which can access files on Dropbox, so it can read and write to the master password file there, which then propagates to the other machines with Dropbox installed.
athreyac8 3y ago
I use BitWarden pretty good
- ParetoOptimal 3y ago
  They recently updated the Firefox extension with very good UX improvements!
soundnote 3y ago
It's definitely suboptimal.
gpvos 3y ago
I don't know, but I use an admittedly clunky setup using Password Safe and my own NextCloud server just to be sure I have complete control.
kevincox 3y ago
Whatever password manager you use I would consider browser integration critical. This is because it will check the domain for you and prevent phishing attacks that may work if you need to copy+paste your password. The fact that the password doesn't auto-fill is a huge red flag that interrupts your regular workflow and requires an unusual manual action to be phished. But whether that is an in-browser password manager or a third-party manager with browser-integration (usually via an extension) probably doesn't matter much.
jhasse 3y ago
Sure, why not?

gchamonlive 3y ago

I don't think so, but since browsers offer this option it should be extremely stable.

the_pwner224 3y ago

I used Firefox's password manager for a long time but eventually switched to KeePass which is FOSS and not cloud based. It's much better than the browser builtin password managers. I store the .kdbx file in Syncthing (== Dropbox) so it automagically syncs between all my computers and phones. Use the KeepassXC app on computers along with their browser plugins, and the KeepassDX app on Android (idk about iOS). One advantage of this is that the passwords work across all browsers. If you use FF's password manager, you only get passwords available in Firefox; but with Keepass they work in FF & Chrome & for native android apps & etc. And with the browser plugins it works about as well as the browser's native password managers. It also has support for TOTP 2 factor authentication. Also I can easily make a copy of the .kdbx file (literally just ctrl-c ctrl-v the file) to save archives of my password db. (That said, over years of having the database open across multiple devices and editing it while open on multiple devices, it's never gotten corrupted)

ddhhyy 3y ago
Similar workflow here. On iOS I use Keepassium, which can access files on Dropbox, so it can read and write to the master password file there, which then propagates to the other machines with Dropbox installed.

athreyac8 3y ago

I use BitWarden pretty good

ParetoOptimal 3y ago
They recently updated the Firefox extension with very good UX improvements!

soundnote 3y ago

It's definitely suboptimal.

gpvos 3y ago

I don't know, but I use an admittedly clunky setup using Password Safe and my own NextCloud server just to be sure I have complete control.

kevincox 3y ago

Whatever password manager you use I would consider browser integration critical. This is because it will check the domain for you and prevent phishing attacks that may work if you need to copy+paste your password. The fact that the password doesn't auto-fill is a huge red flag that interrupts your regular workflow and requires an unusual manual action to be phished. But whether that is an in-browser password manager or a third-party manager with browser-integration (usually via an extension) probably doesn't matter much.

jhasse 3y ago

Sure, why not?