It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can’t remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don’t just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They’re not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser’s password storage is better than nothing. Don’t reuse passwords, use long randomly generated ones.
It’s free, it’s convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I’m preaching to the choir, but if even one of you decides to use a password manager after this then it’s an easy win.
Please, don’t wait. If you aren’t using a password manager right now, take a few minutes. You’ll thank yourself later.
I’ve been using Firefox’s built in password store, plus 2fa for sensitive accounts when possible. Are there any known issues? Uploading all my passwords to someone else’s server sounds silly.
Uploading all my passwords to someone else’s server sounds silly.
KeePassXC is entirely local.
Are there any known issues?
LastPass (ironically) explains this best: https://blog.lastpass.com/posts/2022/06/why-you-shouldnt-store-passwords-in-a-browser
Thanks but the LastPass article is partly inapplicable and partly marketing. The one good point it makes for non-corporate users is about leaving your browser open where attackers can access it, say at the office. For a while I tried using a FIDO2 token but they weren’t well enough supported at the time. Maybe that is easier now.
I guess the reasons I would make would be not all accounts are web-based, and using a browser for anything other than browsing is a bad idea. Browsers aren’t exactly focused on keeping passwords safe, so why not use a tool designed for it? Don’t keep all your eggs in one basket
P.S. Yes, FIDO2 is much more supported
I guess I use a few APIs with auth tokens that are like passwords but I don’t see how a password manager would help. Yeah the tech for this stuff could be better, but vendors keep messing it up.
What about your Lemmy account?
On my laptop I use the Firefox password store. On my phone I mostly use Voyager which presumably stores the password in a protected app file. It could probably be extracted by rooting the phone but that has gotten harder to do, and anyway it’s also in Firefox on the same phone. Voyager is basically an API client. I can see some interesting ways to improve this but haven’t cared enough.
Theoretically, it’s possible to store a encrypted database on someone else’s system in a way where they never have the ability to see its contents, as you encryption and decryption only ever happens in the client on your devices.
Whether this is actually done in a way that enforces that on various password managers is unknowable with proprietary code.
Personally I self-host vaultwarden. All the benefits of syncing my passwords across devices, but the server enabling that, runs on my hardware.
To use that remote encrypted db, you need a stored client side secret, and a customer service department that deals with users who have lost that. See also “mud puddle test”.
and a customer service department that deals with users who have lost that
I’d not heard of the “mud puddle test” but I immediately thought that any provider that does that, is doing it wrong.
Unless there’s an exploit of which I’m unaware, my self-hosted solutions pass the mud puddle test.
Companies have to know about the mud puddle test, but then they have to make an informed decision about whether they want to pass it. Hard disk and data recovery companies have been known to employ grief counsellors to assist their customers in coping with finding out that their disk drive is too trashed for the data to be restored. Choosing to fail the mud puddle test puts the password manager company in the same position. Some customers may, in fact, expect that recovering from the mud puddle is one of the services they are paying the company for. It’s the same reason hosted databases like RDS are a thing. Either way though, the company should be transparent about how they handle this question.
I agree with all of that, I was just pointing out that “uploading all your passwords to someone else’s server” can be done in a way that isn’t silly. You’re preaching to the choir.
Though even then, the best way is for that server to be yours, not someone else’s. And it does come with advantages in terms of convenience.
The benefits of having my passwords on a server (even my own server) seem tiny compared to just occasionally having to type one into a second computer after generating it on the first. If I had used a dozen computers instead of two, maybe it would be something to think about.
I don’t understand.
You only use each passwords once? You never log in to things on a new device without the one on which you created the account on hand? You only ever need authentication on two devices?
I own half a dozen devices on which I might want to log into places, and on several occasions it has been extremely useful to be able to access my password database from a completely new device from anywhere in the world, with nothing but the memorized master credentials.
I don’t think you can argue that the advantages don’t exist, even if they aren’t useful to you personally.
Firefox Sync is end-to-end encrypted. So Firefox’s password manager with syncing does this.
Personally, I use PassWord123! for everything. It says its a strong and secure password so why wouldn’t I use it for everything?
Its the best one to use, all password hacking tools avoid this one when they’re attacking.
deleted by creator
Yeah, true story. Really weird.
deleted by creator
Marginally better than using discord itself as your password manager (also a true story!)
How does this work? Do they ask other people to remember their passwords?
Some people keep journal servers where it’s just them in a server alone, could be that
yes, it’s that.
I don’t even understand why I need to make a password for some sites anymore. They send a code to my phone everytime.to make.sure it’s me so it seems like there’s practically no point.
2FA really stands for
2 FUCKING ANNOYING !!!
Do you not understand how much 2FA helps you? That shit is cash money.
It doesn’t help everyone equally. It assumes you (a) re-use passwords, (b) don’t protect them properly. That’s the case for most people but not all.
It’s also a protection against people who get their hands on your credentials though. You don’t really have any control over a server with your data on it getting compromised, right?
If the password is unique, there’s no risk!
Incidentally: not re-using passwords should be the only responsibility of the user. It’s impossible to brute-force a password through a login form, you need full access to the disk. So when sites complain about poor password strength, effectively they are saying “We don’t trust ourselves to keep our server safe”. Pretty insulting to blame the user for that.
Hmm. Maybe I’m misunderstanding something fundamental about cyber security, but wouldn’t a server leak give you login credentials regardless of the uniqueness or amount of use a password has? And 2FA would still protect against that?
I might have thrown my hat into a ring I have no place in lmao
Unless the website is handled by complete morons it stores credentials in an hashed format. Usually to crack this we’d use rainbow tables or wordlists of known passwords, and essentially we use every word to generate the hash until it matches.
If your password is strong and hasn’t been compromised (check regularly on haveibeenpwned) it will likely not be in any wordlists and it also won’t be easy to crack. Now, password managers can generate the best passwords because they’re completely random and very long by default so to crack them you’d have to try every possible character combination, this takes time, and specifically a time so long that statistically the andromeda galaxy and milky way will merge into one before the password is cracked (at least until quantum computers become a thing, then it’s mere minutes).
2FA helps because even if they crack the password they then need the 2FA code, which you can’t really guess or brute force and is seen on a third party app you don’t control (unless you use sms, they can spoof SIMs ro view the sms you receive and therefore degeat 2FA). It also doubles as something that alerts you that someone is trying to access your account.
I’ve got a random username if the stupid website/app allows it. Most don’t. It has to be your email address.
And a minimum random 20 char password for each website/app. Again if the stupid website/app allows it.
Secure your (I don’t mean you personally) fucking website/app and credentials storage and stop making your weaknesses my problem.
Most places, and all of my stupid financial websites/apps, only have phone/SMS as the second factor. And yet there are plenty of horror stories about people ‘losing’ their phone numbers.
Oh wait. There is one financial site that has developed its own authenticator app. I really expect that to go about as well as storing passwords in cleartext.
Then there’s all the shit websites/apps that I don’t give a fuck about that now insist on having 2FA set up. They’re not interested in the security, it’s just to get your email and phone number to onsell your data to whoever.
It’s fucking security theater.
“Then there’s all the shit websites/apps that I don’t give a fuck about that now insist on having 2FA set up. They’re not interested in the security, it’s just to get your email and phone number to onsell your data to whoever.”
Of everything you wrote, this one had my eyes wide. Hadn’t even crossed my mind that could be a problem. 🤦🏽♂️
I don’t think 2FA being effective needs to be mutually exclusive with being “fucking annoying” -It is a security measure after all, and the one thing security measures never are is convenient.
I mean, using password managers is both more convenient and more secure than 99% of things most user do to handle passwords so idk.
And some like Proton Pass also double as 2FA apps and make that trivially easy too by autofilling everything with a click
Good point. I guess it’s never really bothered me. It’s one of those things I’ve just come to expect nowadays.
I stand by it being cash money though. lmao
Because different layers protect you against different things. It’s like how you have anti-lock brakes, a seatbelt, an airbag, and crumple zones on your car. You don’t just have one thing to protect you.
Password is necessary for two-factor authentication. The factors of authentication are something you know (like a password), something you have (like a cell phone), and something you are (like a biometric).
An example of three-factor authentication would be this—imagine a spy going into a secret bunker. They need to scan their iris, insert a key card, and then enter a passcode before the door opens. This has all three factors of authentication; the passcode is something they know, the key card is something they have, the iris scan is something they are.
If it just sends a code to your phone, that’s one-factor authentication (something you have). Anyone with your phone can get into your account. Unless, of course, your phone hides its notifications and you have a screen lock. Then that’s actually two-factor authentication because you also need to know the phone PIN or have the biometric.
If it just asks for a password, that’s one-factor authentication (something you know).
If it asks for your password and then sends a code to your phone, which you need a fingerprint or face scan to unlock, you have achieved three-factor authentication.
Edit: Interesting tidbit—in the USA, you can rent a mailbox at the post office to receive mail when you don’t want to give out your real address. Useful for privacy reasons. I’m sure they have similar things in other countries. These mailboxes come with a key. This is actually two-factor authentication, because the keys usually don’t have the mailbox number written on them! So you have to have the key and also have to know which mailbox among the hundreds at the post office it opens.
Been using 1Password for 6+ years and I probably won’t use anything else ever. My wife and I both use it and have a shared family vault for things we both use. I couldn’t live without a password manager.
I have been using password gestoires for a long time. First LastPass, until I switched to GNU/linux and discovered Keepass and then KeepassXC… For me they are indispensable. That’s the one I used until about 1 year ago when I started having problems with the Firefox addon. It did not recognize the pages. I tried ProtonPass and I like it, but I don’t like having them online, no matter how secure the site is. I’ve tried going back to KeepassXC, locally, but the file I export from ProtonPass won’t load in KeepassXC. I feel stuck.
Translated with DeepL.com (free version)
I’ve tried going back to KeepassXC, locally, but the file I export from ProtonPass won’t load in KeepassXC. I feel stuck.
Open a bug report in KeepassXC’s repository, maybe it’s a big in their code. Or they’ll tell you that the bug is in proton pass, and you can report it there too so that they know about it and can fix it. Maybe the KeepassXC team can give you a workaround too
Open a bug report in KeepassXC’s repository, maybe it’s a big in their code. Or they’ll tell you that the bug is in proton pass, and you can report it there too so that they know about it and can fix it. Maybe the KeepassXC team can give you a workaround too
My English is very poor for technical explications… I search the issue in KeepassXC Github but I don’t found similar solution.
Proton Pass is a pretty new service, maybe there haven’t been much users yet who have moved to KeepassXC from it. I would say give it a try, it’s not that bad.
Something else you could try is:
a) check the Bitwarden repo if anyone had a similar problem as you. If so, it’s more likely that it’s a Proton Pass problem, and maybe they have some tips.
b) import your Proton Pass export to another password manager (Bitwarden, original Keepasd), export it from there, and try to import this in KeepassXC. Though this might have a higher chance of losing some information, in the sense of metadata. If you go this way, don’t forget to make a fresh export of your Proton Pass account, in case you have changed something there in the meantime
Did you export ProtonPass to CSV?
I’ve been using Proton Pass and it has been a game changer for me. Hot take: I think Proton Pass is Proton’s best service.
It creates not only a unique password for each service but also a unique email address alias. If a website leaks my email address and I get spam, I know exactly who did it and I only need to swap 1 login credential.
Has a built-in 2FA and passkeys. Works great in the browser with proper auto complete, even for the 2FA code. Works fine on Android and password in both browser and applications get autocomplete.
Proton Pass can be used by everyone, regardless of their technical level, in every device. My mom could easily use this across all her devices. I’m told Keepass is fantastic but having it sync across all her devices would be challenging for her.
Most Proton services feel kinda underbaked but Proton Pass is excellent.
I’m a little miffed that 2FA support is a paid feature.
I’m using KeePassXC and have no intention of switching, plus I’m paying for an account anyway, I just feel that 2FA is such an essential feature for a password manager that it shouldn’t be locked behind a paywall.If that wasn’t a scripted ad, you should go into sales.
I have worked in retail to help pay for university. It was a miserable job. Dealing with people made me a worse person.
I am very “passionate” about Proton Pass but don’t take me for a Proton chill, I have a lot of criticism about their other products.
I actually came here to echo this exact sentiment. I was on Lastpass until their first breach and then on Bitwarden both cloud and self-hosted until a few months ago when I set up with Proton. I liked Bitwarden so I put off trying ProtonPass. One weekend I set it up and ended up putting my 2FA items in as well. It feels absolutely seamless to use. The email aliasing for websites is so easy for making new website accounts. In my desktop and laptop browser the way it automatically offers to autofill the 2FA is so clean. I can’t see myself going back unless Proton gets prohibitively more expensive or the product declines in usability/security. If you are currently using Proton’s suite of apps give Protonpass a try. You can easily import from Last pass/Bitwarden and use both to compare side by side.
Is ProtonPass okay?
just. write it down? in a notebook? keepassxc is rly good if you dont want to do that though
This is not a real solution. You’re supposed to have a unique password for everything. Managing that notebook would be an hassle, not to mention backing it up. It would easily have dozens of records, if not hundreds.
oh shit fair enough!! i use temp-mail.org for most things so i frogot about accounts for every tiny service lmao
But what if you lose the notebook? Or just don’t have it on you, when you need it? God help ya if someone malicious gets it. Keep it digital, always available, backed up, and secure.
On the plus side, the more people who don’t use password managers the more chance us password manager users will remain not worth the effort.
It’s kinda like security through obscurity mixed with only having to be faster than the slowest person to outrun a lion.
I disagree. Password managers are still target of threat actors, a juicy one at that, but it’s not too often you hear of breaches of good password managers. Chances are the people behind the good password managers are better at security than 99% of users (including more technical ones). Even after a breach exporting all the passwords and moving them to another service, and changing all your passwords again with more secure ones is trivially easy.
If everyone used them sure there’d be more pressure on said password managers but hackers will find it a lot more difficult to hack anything in general and it will still not be worthwhile to hack average users who use a password manager.
If you’re on Linux and you don’t want to use KeepassXC, you can check out Secrets on Flathub, it has imo a better UI/UX
If you’re on Linux and you like minimalism, pass is also a great option
Interesting, thanks for the recommendation.
Self-hosted bitwarden. Highly recommend
I self-host a lot of stuff. But password manager just feels risky to me. Like what if I mess up and lose all my data or something.
With bitwarden being encrypted and all I just didn’t see any down side to using their server. Plus more convenient since I don’t have to VPN to use it. Or open a port.
All of that just to ask. Am I missing something? Should I be self-hosting it? I wondered about using both so I’d have a backup ether way. Or in case their servers go down for awhile. But that’s super rare.
VaultWarden is a damn godsend.
And also set-up SSO/LDAP in your homelab if you run one so you don’t have 3000 loose outdated account entries for IPs like 192.168.10.5 user: admin password:*****
i dont understand this post. like every browser has a password manager, why install some 3rd party you can even trust less?! am i missing something? doesnt safari have a password manager? is keepasscx really safe (CVE-2023-32784)? or bitwarden (https://blog.redteam-pentesting.de/2024/bitwarden-heist/)?
With keepasscx YOU have the password-file. Period. You know what’s been done with it: Nothing, as it doesn’t phone home except update-checks. Which you can also disable.
With the browser-addon you’ll get the same result but with control.
Bitwarden exploit was already patched. And required a domain joined PC with Windows Hello active, and the attackers already had access to the DC. Not exactly a large vector. Also enterprise PCs shouldn’t be using windows hello to begin with, IMO. Now if we look at CVEs affecting browser password managers, there are literally exploits for download on GitHub.
In-built password managers for browsers are straightforward to crack. Like… Terrifyingly easy. It’s much better to use something like Bitwarden, Vaultwarden if you don’t trust Bitwarden, 1Password if you really want the reassurance of paying someone for trust, or KeePass if you don’t trust anyone at all (I, personally, fit into this category).
show me an example of the firefox password manager being “cracked”. i mean i still sync them into my local nextcloud. @[email protected] suggests it is cool to have your passwords in a file?!
doubt there is a scenario where using MORE services makes anything safer. Well maybe for Windows Users…but thats a dying species with the win11 crap.
so no. third party corpos…the worst.
My sell on password managers is quality of life. You never have to reset your passwords and you can use a hotkey to enter it faster than typing. Gone are the days of fat fingers.
But I get where people have an issue. It’s one point of failure vs. many, but they don’t realize It’s easier to well secure the one than it is to not spread the same vulnerability everywhere.
Honestly as someone who has helped family members set up a password manager one person felt this way and the rest are just not tech savvy. All the simple straightforward stuff took ages because they had never done it before.
