111–120 of 196 posts
Switched to BitWarden a few months ago from years of using LastPass. Zero regrets... it is in every way better for my use case. Switching wasn't hard either. Even gave BW my money, it is worth supporting them.
Love to hear more about why BitWarden is a safer choice than Lastpass if anyone cares to chime in. Thanks.
Earlier quoted context omitted.
> KeePass and similar are a better way to go, if slightly more labor intensive. Slightly? Just thinking about the synchronization between machines makes this an understatement in my opinion.
I store the keepass file in a cloud sync service. The file is encrypted. The keepass application can perform "auto-type" which works for all sensible applications and websites that have username/password input fields and a log-in button. Recently, more and more websites split the log-in into two screens, first email and then password. This completely breaks auto-type and is horrible in every way. Please don't do it.
You are right that this is a good approach for many it will certainly break for many as well.
Earlier quoted context omitted.
I'm avoiding the browser extensions, they seem to be a security nightmare. KeePass and similar are a better way to go, if slightly more labor intensive.
KeePass isn't a solution in case you want to share passwords with family or team members. KeePass is barely decent for personal use only, and only for the desktop. The quality of the available apps differs from platform to platform. For example Bitwarden has a decent iOS app, 1Password has a superb iOS app and in contrast the available KeePass app for iOS is a piece of shit – no offense intended but it's basically un…
There are multiple .kdbx apps, like MiniKeePass on iOS, which is decent, but it's lacking active development at the moment.
I am seriously considering alternatives to LastPass. Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me. Almost never actually fills in my passwords (often have to click copy password), often thinks I am on a different website than I am, or just gives me an empty white box when I click the LastPass button.
If you are only on Apple devices I would stay with Keychain Acess. Multi-platform? Bitwarden for me - if only for the external security audit they've done.
Earlier quoted context omitted.
> Since they moved to a dedicated app instead of just a plugin on Mac, it is borderline unusable for me. What do you mean? They still have browser extensions for all major browsers.
Unless I am missing it, the only way to install it on Mac now is to install an App that acts as your vault and it installs the plugins. (if I click "Open my Vault" it opens a dedicated LastPass App on my Mac)
I use Firefox and the LastPass extension without needing to use the Mac app.
Earlier quoted context omitted.
> KeePass and similar are a better way to go, if slightly more labor intensive. Slightly? Just thinking about the synchronization between machines makes this an understatement in my opinion.
I use dropbox to keep my db sync'd between my desktop and android phone.
This is one reason why I believe that browser based password managers are flawed. I've written about this in the past (link below). These apps are popular with normal people (due to convenience), but long-term, we should not trust web browsers plugins or add-ons as password managers. https://github.com/w8rbt/dpg#why-traditional-password-manage...
While in browser password managers have drawbacks, they have the big advantage that they stop fishing / fake domain attacks. I think I'm much mor likely to fall for one of those, than my password manager get hacked. Also, generating all passwords off one master password deterministicly sounds like an awful, awful idea. If someone manages to get one of my passwords, they can try performing an offline attack against th…
I've love to switch away from LastPass. I switched to LastPass Families when it came out due to their "digital contingency plan" so family members (or the trusted family attorney) can get access to passwords rather conveniently if I or another family member passes away. At the time, I didn't see that other offerings made this as easy. Any other good options out there for this use case?
Earlier quoted context omitted.
I store the keepass file in a cloud sync service. The file is encrypted. The keepass application can perform "auto-type" which works for all sensible applications and websites that have username/password input fields and a log-in button. Recently, more and more websites split the log-in into two screens, first email and then password. This completely breaks auto-type and is horrible in every way. Please don't do it.
This works if your environment allows a) installing applications and b) cloud sync using consumer clouds (dropbox, gdrive, etc You are right that this is a good approach for many it will certainly break for many as well.
Re a) https://keeweb.info/ toss this onto any ol' free tier web host you want. No app install necessary. It's not as nice as the apps, but it works.
Re b) Is there an environment that both has a web browser that you want password management with and doesn't let you access any consumer cloud sync service?
Earlier quoted context omitted.
They also give you the option to self-host, so you don't have to trust their hosting service if you don't want to. Own your data!
Can you trust your own hosting though? Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. It is easy to misconfigure Linux to be insecure, most distro's ship with too much software, and auto-update is often inadequate to maintain a secure environment. There's far too many compromised Linux servers out in the world that people set up "to do one thing" turned on auto-update and t…
Yes it is. It's a docker image, you're not setting up anything about the host that's exposed to the internet. Toss on watchtower to auto-update it and why would you ever need to touch it again?
The system hosting docker isn't getting updates, no, but it's not publicly reachable, so that's low risk. The system that is publicly reachable is entirely contained & auto-updated, so that's covered. What else is there to worry about?