Securely Yours, Love Password Managers (2021)
1–10 of 41 posts
Re: Securely Yours, Love Password Managers (2021)
#2My go-to recommendation has been Bitwarden, but if you're worried about an external dependency and don't want to run their self-hosted option, then I've found KeePassXC to be fantastic too. I have to use it on my client development macbook due to their security rules and was initially very reluctant to move away from Bitwarden. The client's security dept says no password manager can request stuff from outside the machine it's installed on.
KeePassXC is a little clunky to set up the link between your local instance and your browser(s) but once that is done, it's straightforward and seems to work very well.
EDIT: Bitwarden recently added passphrases to its generator feature. I personally prefer long random passwords but I know some folks prefer to remember a phrase.
Re: Securely Yours, Love Password Managers (2021)
#3My go-to recommendation has been Bitwarden, but if you're worried about an external dependency and don't want to run their self-hosted option, then I've found KeePassXC to be fantastic too. I have to use it on my client development macbook due to their security rules and was initially very reluctant to move away from Bitwarden. The client's security dept says no password manager can request stuff from outside the mac…
I can say the same re: KeepassXC. I'm using it on all my devices (except Keepass2Android on my phone) and synchronize the database using Syncthing. Works like a charm.
The one gripe I have with it is its KeeAgent emulation on Windows: It works with Putty (AFAIK) and Microsoft's official OpenSSH port (which gets more and more out of date), but it doesn't mesh well with MSYS2 or Cygwin. And interoperability between those is still really poor.
Re: Securely Yours, Love Password Managers (2021)
#4I'm a big fan of Enpass [1]. It's user friendly enough for the not so technical members of my family to use it and importantly (for me) sync is achieved via encrypted files stored on Google Drive (other services such as Dropbox are also supported).
Re: Securely Yours, Love Password Managers (2021)
#5"at least 8 characters, uppercase/lowercase, numbers, special characters" - I thought the more current recommendation was to use a longer passphrase rather than an overcomplicated and hard to remember password? Of course this hasn't yet got through to many sites, and apparently also not to all security experts...
As for "love", I don't think LastPass (which is unfortunately mandated by my company) loves me, and when I see its egregious UI and its idiotic prompts to fill in passwords on sites to which they don't belong to (not to mention prompting me to save passwords which I definitely don't want to save to LastPass, but unfortunately the popup only has a "Not now" button, not a "No, never" button), I don't really have any love for it either...
Re: Securely Yours, Love Password Managers (2021)
#6Given today's cloud hardware availability the leaking of the hash of an 8 character password is only good for a few days. The current reasonable minimum is 12 characters.
Re: Securely Yours, Love Password Managers (2021)
#7I personally use the Keepass "suite" as follows:
* KeepassXC on desktop (linux)
* KeepassDX on mobile (Android)
It's synced any way you like: NextCloud, Syncthing, Dropbox, you name it.
Re: Securely Yours, Love Password Managers (2021)
#8I personally use the Keepass "suite" as follows: * KeepassXC on desktop (linux) * KeepassDX on mobile (Android) It's synced any way you like: NextCloud, Syncthing, Dropbox, you name it.
+1 for KeypassXC. For those looking for an iOS app, I recommend Strongbox[1]. It’s open-source and it’s the most feature complete solution I’ve found. (Not affiliated, just a happy user)
Re: Securely Yours, Love Password Managers (2021)
#9"at least 8 characters, uppercase/lowercase, numbers, special characters" - I thought the more current recommendation was to use a longer passphrase rather than an overcomplicated and hard to remember password? Of course this hasn't yet got through to many sites, and apparently also not to all security experts... As for "love", I don't think LastPass (which is unfortunately mandated by my company) loves me, and when…
A passphrase isn't stronger than a password created using those rules - it's preferable if your strategy is to remember your passwords. The problem is that there are so many logins it's hard to keep track. So the temptation is to start reusing passphrases across sites which is the big no no because every site will be breached eventually, it's just a matter of time. And once your passphrase is compromised attackers will start credential stuffing on every other site of interest, looking for where you have reused it.
Of course 2fa, hashing, salting, etc are better solutions but there you're putting your security in the hands of some unknown developers and hoping they know what they're doing.
Security in depth is all about layers. Password managers aren't the perfect solution to the user layer, but for me they're the least worst option.
Re: Securely Yours, Love Password Managers (2021)
#10Given today's cloud hardware availability the leaking of the hash of an 8 character password is only good for a few days. The current reasonable minimum is 12 characters.
I really wish there was a good standard for password length requirements for websites.
Far too many sites out there reject longer passwords, or have a strange dislike of a single special character (which of course differs between sites)
Let me use 64 character passwords, dammit!