Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage your passwords in 2023?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 179 posts

Re: Ask HN: How do you manage your passwords in 2023?

#11

Post by sph »

Bitwarden does all my password and OTP management. Works on any browser and operating system, it's open source and audited. All the services I use have 2FA enabled, and I try to avoid SMS second factor as much as possible.

My email and Bitwarden itself are secured by two Yubikeys, one is always on my person on my keychain, the other is physically stored away from my house. I have an AirTag on my keychain because losing your keys is a pain in the butt.

This is a cheap yet very secure system for most people that care about security but are not persecuted by police or government agencies.

Re: Ask HN: How do you manage your passwords in 2023?

#13

Post by maccard »

1password everywhere. Employer pays for it, and I have a separate vault for personal and work credentials, meaning I don't have any work credentials on personal devices and work has no claim over my personal credentials. Works on my iPad, MacBook, windows workstation and android phone seamlessly.

My only complaint is that it doesn't let me use a yubikey as a primary method of authentication on windows - all my other devices have biometric authentication.

Re: Ask HN: How do you manage your passwords in 2023?

#14

Post by hartem_ »

acjohnson55 wrote: post #7

I use 1Password. It isn't perfect, but it's quite good. My big goal now is to come up with a better solution for 2FA that works for me and my wife's shared accounts.

Aren’t you using 1Password for generating one time passwords? Or do you deliberately want to keep them out of it?

Re: Ask HN: How do you manage your passwords in 2023?

#17

Post by princevegeta89 »

edent wrote: post #9

I use - and pay for - BitWarden. It does all the things you ask for. With the paid version I can share passwords with my spouse for relatively unimportant things (like Netflix) in a reasonably secure manner. I could self host and run it myself. But I'm not a multi-person team with decades of security engineering experience. So I gladly let someone else take on that burden.

You don't need to be a multi-person team or have a lot of security experience to host Bitwarden.

I'm very positive Bitwarden won't get hungry for money looking at their revenue models, but there's always Vaultwarden you can self host. It's pretty popular and secure. I'll be deploying soon for myself.

Re: Ask HN: How do you manage your passwords in 2023?

#19

Post by jon-wood »

simsim981 wrote: post #10

If you have a Mac use keychain. I never understood why Mac users use external tools.. I mean really? Why? Perhaps if you manage a team at work ok.. but single user subscriptions? For Linux and windows i would use keepassx.

I would use Keychain with it’s iCloud sync if I didn’t occasionally use non-Apple devices.

Re: Ask HN: How do you manage your passwords in 2023?

#20

Post by xoa »

One of my major goals for 2023 is to migrate as much as feasible from passwords to tokens or at least passkeys. NitroKeys or YubiKeys for that. Process has already begun, but I definitely hope to see that accelerate big time (at long, long last) this year. Feels like there is serious industry momentum from the big players this time, and that cost, UX, support in frameworks to make it easy for non-sec webdevs, may all finally start to reach the tipping point. US Government is onboard now too, having dumped lots of obsolete terrible advice for a refreshingly great set of modern guidelines and updating government service sites in general for good uniform login with hardware token support. Ideally I'd like to see that become more universal for various web GUIs/access for services too (OPNsense in particular, which I now use for firewall/gateway services and is probably one of the more security critical bits of my infra).

Passwords though will have a very long tail even in the most optimistic scenarios, so yes password managers aren't going anywhere for a while yet. What I use right now is 1Password 7 with a slow migration towards Bitwarden clients and a self-hosted Vaultwarden server. I still have a standalone license and still have shared vaults in Dropbox, I will not be moving to the electron based 1P8. So end of the line on that decade+ journey I'm afraid, I'm disappointed with what happened with them but so it goes. Bitwarden/Vaultwarden seem solid to me so far though, and have client support across a range of devices. Nebula or Wireguard make keeping a bunch of selfhosted services accessible in a reasonably secure way pretty easy, and almost more importantly once setup have been rock solid reliable for me. Wrapping my head around them and making sure I had it all figured out certainly took a bit of time early on, but once setup it's Just Worked™ without being touched a single time ever again. No specific 3rd party dependencies is attractive.

If you have family/friends/coworkers to deal with though obviously the needs of the group are going to have to factor in on some level, and you may find you need to either run a few different things or compromise somewhat/pay more.

Post reply on HN