Ask HN: How do you manage your passwords in 2023? • Hacker News Board

Re: Ask HN: How do you manage your passwords in 2023?

#121

Post by shellfishgene » Sun, Jan 01, 2023, 10:03 PM UTC

charles_f wrote: post #112

KeepassXC sync'd with onedrive. I use a certificate key that I only move with USB, and a Yubikey to limit the attack area if someone were to gain access. Keepass2android works very well. For the longest time I avoided the browser extension since it's a weak spot, and instead relied on auto-type. I finally caved in since most websites nowadays use a UI that asks for the user name first and then the password because re…

KeepassXC supports custom auto type sequences, such as "name, enter, wait, pw, enter" for sites that ask the password on a second page.

Re: Ask HN: How do you manage your passwords in 2023?

#122

Post by lampshades » Sun, Jan 01, 2023, 10:08 PM UTC

evolve2k wrote: post #120

lampshades wrote: post #61

Earlier quoted context omitted.

Have fun changing those passwords. It took me at least three days. Absolutely miserable experience to conclude my 7 year relationship with LastPass.

What?! You can’t import/export between them? That’s what I did when I left LastPass for 1Password, was fairly straight forward from what I remember.

I had to reset them regardless because of the breach so didn’t even bother looking into exporting/importing.

Re: Ask HN: How do you manage your passwords in 2023?

#123

Post by worldsavior » Sun, Jan 01, 2023, 10:09 PM UTC

mike-cardwell wrote: post #110

Stored encrypted using gpg, in a git repo which is synced using syncthing: https://www.passwordstore.org/

FYI, gpg is soon considered insecure, even now.

Re: Ask HN: How do you manage your passwords in 2023?

#124

Post by lampshades » Sun, Jan 01, 2023, 10:09 PM UTC

graftak wrote: post #114

Tijdreiziger wrote: post #104

Earlier quoted context omitted.

Sorry, I meant notes associated with each site/password. Sometimes you want to record not only a site’s username and password, but also some extra data, so having a notes field comes in handy.

Yes it does, I keep my recovery codes there.

This is what I do. As well as SSH keys.

Re: Ask HN: How do you manage your passwords in 2023?

#125

Post by monsieurbanana » Sun, Jan 01, 2023, 10:15 PM UTC

lelandfe wrote: post #111

atonse wrote: post #35

Earlier quoted context omitted.

1Password with shared vaults and OTP fields works well for this. I understand the idea of putting both factors in one place is odd, but I feel it strikes the right balance between the convenience and security.

> the idea of putting both factors in one place is odd This is AKA "one factor", right?

If your password is compromised they still don't have access to your OTP, so 2 factor. If your password manager is compromised then they have both, 1 factor.

I'm no math wiz but pretty sure that makes it a 1.5 factor

Re: Ask HN: How do you manage your passwords in 2023?

#126

Post by bkraz » Sun, Jan 01, 2023, 10:30 PM UTC

I've been using Bitwarden for a few years, and am very happy with it. I'm glad to pay their reasonable price.

Re: Ask HN: How do you manage your passwords in 2023?

#127

Post by aidenscott2016 » Sun, Jan 01, 2023, 10:31 PM UTC

worldsavior wrote: post #123

mike-cardwell wrote: post #110

Stored encrypted using gpg, in a git repo which is synced using syncthing: https://www.passwordstore.org/

FYI, gpg is soon considered insecure, even now.

You can’t make a statement like that without clarifying what you mean and sharing some alternative to gpg

Re: Ask HN: How do you manage your passwords in 2023?

#128

Post by dwightgunning » Sun, Jan 01, 2023, 10:33 PM UTC

For a long while I've trusted and used various KeePass ports/forks on my phone and laptops and stored the password file in cloud storage.

With the recent LastPass exposure, the supply-chain attack on PyTorch, needing to be vigilent and avoid granting apps access to my cloud drive, I've actually just been reviewing my setup and workflow.

Here's what I'm planning to change...

Phone: Switching from MiniKeePass to KeePassium. I've found it's not too difficult to build KeePassium from source and install without needing an Apple Developer subscription. This means I can properly audit the code and control/verify all updates.

Laptops: Start building KeePassXC from source. In the short term, I'll be more diligent in obtaining updated versions from trusted sources and using PGP to verify the package.

File sync: Start storing the password file on a self-hosted file server. Having recently setup Tailscale on all my devices, it's now convenient to manage Samba and remove cloud storage from the system. In case the SMB share is inaccessible, I'll fallback to the backups kept by KeePassium and use cron+rsync to maintain an secondary copy on my laptop.

Backups: I'm planning to periodically backup to a hardware keypad encrypted USB drive. In comparison to a regular USB / external drive, the hardware encryption makes it harder for somebody to quickly make a copy of the password file and take it away to be brute-forced.

Would welcome any pointers on things I may not be considering or suggestions for improvement!

Re: Ask HN: How do you manage your passwords in 2023?

#129

Post by fortran77 » Sun, Jan 01, 2023, 10:36 PM UTC

evolve2k wrote: post #120

lampshades wrote: post #61

Earlier quoted context omitted.

Have fun changing those passwords. It took me at least three days. Absolutely miserable experience to conclude my 7 year relationship with LastPass.

What?! You can’t import/export between them? That’s what I did when I left LastPass for 1Password, was fairly straight forward from what I remember.

You can import/export, and it worked well. But you still have to change every one, and reset your OTP token generators if you stored them in LastPass as well

Re: Ask HN: How do you manage your passwords in 2023?

#130

Post by tsuujin » Sun, Jan 01, 2023, 10:41 PM UTC

lampshades wrote: post #58

I just use iCloud. I’m fully in on iCloud now that they support custom domains, even moved my gsuite over this holiday season. The password manager is enough for me and just works (tm) with all my devices. It even supports 2fa. I used LastPass until the most recent hack. I prefer iClouds keychain so far. The only problem is using Chrome. There are no extensions for keychain so I have to copy paste the password into C…

I’ve been doing this for a while too. I used lastpass for a couple of years then bounced between dashlane and 1Password for a bit, but when apple added 2fa I dropped everything else and use it exclusively.

There are some UX things I would like to see improved, notably I would really like to manually edit the list of domains for a given password. Overall though I have been very happy and I feel like my daily needs are simplified.