11–20 of 250 posts
I recently got one for my parents (as they use and keep loosing post-it’s) and it has fields for username, password, secret question and notes.
Use KeePass. It's FOSS, has a great extension for FF, and stores your passwords in a local, encrypted file. No cloud necessary.
If your PC is compromised it's pretty much game over, using a password manager does not really worsen the damage in that scenario At that level of compromise they can probably add a root cert, MITM your connections, and grab your passwords anyway. If you're concerned, you could use separate files for different levels of security, which would give you the theoretical ability to compartmentalize the loss. But again, if…
But with a password manager - they get 100% of usernames + passwords to every site you've ever used, even if you dont visit it after the compromise...
I have a file of the first word that comes to mind for every letter in the alphabet. Then my password is created based on some features of the site.
I.e. eBay has 4 letters so I could choose: 'Elephant_4_Yankee'
The delimiter is up to you and you could just as easily choose every second letter or whatever.
Yes, it does mean my Netflix password is a bitch to put in but I know it off by heart.
sha256("password"+domain)
Regarding the user interface don't get me started on keepass. It was recently forked into keepassxc but the chromeipass/ foxipass integration does not work all the time. Also love it if a website just shows your username already and you have to fill out the password and can't use hotkeys. (I am looking at you google) Lastpass can do it successfully, but keepass...
The Android interface was last tested a few years ago by me and it only had a notification area you had to always show. I don't know if it is much better at the moment.
Regarding your password security: Lastpass itself encrypts your passwords and hashes them thousand times. You can also manually adjust the hashrate to even more. So even if lastpass would get cracked. You would have to try out every possible hashing number with every possible password combination. So thats a plus. Well compromising your pc and installing root would be your least concern. It would be easier to steal your phone, get your fingerprint and unlock your database this way.
You can never be 100% secure. But have to choose your best way of doing it.
Also i am open to suggestion regarding a great password manager for android. Will have to try out keepass and dashlane again.
Use KeePass. It's FOSS, has a great extension for FF, and stores your passwords in a local, encrypted file. No cloud necessary.
If you're not expecting to be specifically targeted, then "modify a single password per service" can be surprisingly secure. Don't just add "tw" "fb", but memorize a more complicated algorithm that's not obvious from inspecting two or three leaked passwords. e.g. Basic Caesar Cipher on the odd characters of the passwords using some part of the service name (fb, tw) as a key. Memorize a single algorithm that you can do mentally. Use something completely different for primary accounts (probably bank + main email that allows you to reset other accounts' passwords).
Some people will disagree and say "just use a secure password manager", but there is a valid argument that managers are not necessarily the best solution, depending on your use case.