4 ms·

At this point it is too high of a risk to store my password elsewhere. I've been screwed over by dashlane, lastpass, potentially bitwarden now, I am with 1passw

by kjuulh 5mo ago

At this point it is too high of a risk to store my password elsewhere. I've been screwed over by dashlane, lastpass, potentially bitwarden now, I am with 1password now, but I've had my passwords in all these places, and I've had to change them each time, probably missing a few. I like 1password, it is by far the highest quality product I've used in this category. I moved from BitWarden back then because their browser integration was quite poor. I think I'll move to something custom, or a selfhosted keepass server, with the rugpulls, incidents, and whatnot, it is becoming too high of a risk.

dpacmittal 5mo ago
For the same reasons, I imported all my passwords to Firefox and I'm satisfied with it. I have the option to self host if I don't trust Mozilla
- _karie_ 5mo ago
  Any malware or LLM with user-level filesystem access can attack the outdated KDF [1] and/or wait for Firefox to be running with an unlocked credential store and read the decrypted passwords from Firefox's process memory. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=973759 https://bugzilla.mozilla.org/show_bug.cgi?id=973759
  - jcattle 5mo ago
    Isn't it game over anyway once you have an adversary on your system capable of reading process memory?
    - _karie_ 5mo ago
      [dead]
ozten 5mo ago
How were you screwed over by these products?
- kjuulh 5mo ago
  Rug-pulls, security incidents, lost passwords, I also don't know if they've kept my passwords behind when i deleted my accounts. The risk of them having them is too high, so i had to swap all of them.
  - ozten 5mo ago
    Interesting! I've been a LastPass and then 1Password user since 2009ish. I left LastPass because of UX paper-cuts, but I've never lost passwords on either of them. Honestly, it's something I don't want to think about and just need it to work on mobile and desktop, so the switching friction is very high for me. I'm not going to shop around and try different password managers. Is "rug pull" a cost thing? I'm generally frugal, but pay for a family plan and don't think twice.
advisedwang 5mo ago
keepass files + syncthing works very nicely for me. For non technical people, I just recommend to use the browser built in password managers. traviso has a good writeup why: https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html
- deleted 5mo ago
  [deleted]
- hannofcart 5mo ago
  I was doing this too until recently. The problem with this setup is more at Syncthing. More specifically, Syncthing Android app has seen some troubling changes in maintainers. The latest maintainer has a very sparse Github profile and an AI generated avatar, so I noped out of installing it right then.
  - advisedwang 5mo ago
    Previously I used keepass + drive. That also works well (I just wanted to avoid storing my password db in the cloud for multiple reasons).
thewebguyd 5mo ago
Keepass has been my go to since forever, highly recommend. I never jumped on the SaaS password manager train when they started coming out, always just kept it local. There were times I thought I was missing out on some convenience but I'm glad I never moved. Depending on your threat model, you can even just keep the .kdbx in cloud storage somewhere and point your keepass client to that. I'd recommend using a keyfile in addition to your master password though so that if anyone does happen to get a hold of the database they can't just make brute force attempts against it.
- l72 5mo ago
  I’ve found being able to share passwords with my spouse very valuable which we couldn’t easily do with keepass. Also the syncing strategy on iOS is a disaster and corrupted my wife’s keepass db causing her to lose everything.
- lanfeust6 5mo ago
  Is there reasonably priced cloud storage for this use-case? Their offerings are usually for several gigs of data, a kdbx is minuscule
  - baal80spam 5mo ago
    In theory, you can just use a public (free) github repo for this.
ngruhn 5mo ago
Serious questions: what's wrong with just using Firefox built in password manager?
- cryptos 5mo ago
  It is limited to ... well ... Firefox! Sometimes you need passwords elsewhere. Besides that Firefox (or other browser password managers) doesn't support more advanced use cases like shared vaults.
- radley 5mo ago
  If you only need to manage online passwords, only use Firefox, and aren't using an iOS device, then it's probably fine. But most people may also need to use native apps, other browsers, and iOS devices.
  - ngruhn 5mo ago
    You can absolutely access firefox passwords from any iOS app. You can even configure it as the default password app.

by kjuulh 5mo ago

dpacmittal 5mo ago

For the same reasons, I imported all my passwords to Firefox and I'm satisfied with it. I have the option to self host if I don't trust Mozilla

_karie_ 5mo ago
Any malware or LLM with user-level filesystem access can attack the outdated KDF [1] and/or wait for Firefox to be running with an unlocked credential store and read the decrypted passwords from Firefox's process memory. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=973759 https://bugzilla.mozilla.org/show_bug.cgi?id=973759
- jcattle 5mo ago
  Isn't it game over anyway once you have an adversary on your system capable of reading process memory?
  - _karie_ 5mo ago
    [dead]

ozten 5mo ago

How were you screwed over by these products?

kjuulh 5mo ago
Rug-pulls, security incidents, lost passwords, I also don't know if they've kept my passwords behind when i deleted my accounts. The risk of them having them is too high, so i had to swap all of them.
- ozten 5mo ago
  Interesting! I've been a LastPass and then 1Password user since 2009ish. I left LastPass because of UX paper-cuts, but I've never lost passwords on either of them. Honestly, it's something I don't want to think about and just need it to work on mobile and desktop, so the switching friction is very high for me. I'm not going to shop around and try different password managers. Is "rug pull" a cost thing? I'm generally frugal, but pay for a family plan and don't think twice.

advisedwang 5mo ago

keepass files + syncthing works very nicely for me. For non technical people, I just recommend to use the browser built in password managers. traviso has a good writeup why: https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html

deleted 5mo ago
[deleted]
hannofcart 5mo ago
I was doing this too until recently. The problem with this setup is more at Syncthing. More specifically, Syncthing Android app has seen some troubling changes in maintainers. The latest maintainer has a very sparse Github profile and an AI generated avatar, so I noped out of installing it right then.
- advisedwang 5mo ago
  Previously I used keepass + drive. That also works well (I just wanted to avoid storing my password db in the cloud for multiple reasons).

thewebguyd 5mo ago

Keepass has been my go to since forever, highly recommend. I never jumped on the SaaS password manager train when they started coming out, always just kept it local. There were times I thought I was missing out on some convenience but I'm glad I never moved. Depending on your threat model, you can even just keep the .kdbx in cloud storage somewhere and point your keepass client to that. I'd recommend using a keyfile in addition to your master password though so that if anyone does happen to get a hold of the database they can't just make brute force attempts against it.

l72 5mo ago
I’ve found being able to share passwords with my spouse very valuable which we couldn’t easily do with keepass. Also the syncing strategy on iOS is a disaster and corrupted my wife’s keepass db causing her to lose everything.
lanfeust6 5mo ago
Is there reasonably priced cloud storage for this use-case? Their offerings are usually for several gigs of data, a kdbx is minuscule
- baal80spam 5mo ago
  In theory, you can just use a public (free) github repo for this.

ngruhn 5mo ago

Serious questions: what's wrong with just using Firefox built in password manager?

cryptos 5mo ago
It is limited to ... well ... Firefox! Sometimes you need passwords elsewhere. Besides that Firefox (or other browser password managers) doesn't support more advanced use cases like shared vaults.
radley 5mo ago
If you only need to manage online passwords, only use Firefox, and aren't using an iOS device, then it's probably fine. But most people may also need to use native apps, other browsers, and iOS devices.
- ngruhn 5mo ago
  You can absolutely access firefox passwords from any iOS app. You can even configure it as the default password app.