Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage your passwords in 2023?

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 179 posts

Re: Ask HN: How do you manage your passwords in 2023?

#161

Post by mdaniel »

sowbug wrote: post #154

If I can piggyback on this question, what do people do about those infernal security questions? Browsers don't help much with them.

1Password has a handy solution to that problem: https://support.1password.com/generate-security-questions/

They have a bunch of "standard" questions in the drop-down list, like "first grade teacher" or whatever, but you can always just type your own since they're merely designed to be helpful. The answers they generate are built on top of their normal password generator, but I found the "battery horse staple" variety makes for the least amount of headache, although you could probably generate a PIN format if the target website accepted it since it'd be much easier to read to a customer service rep if it came to that (err, aside from the social hurdle of "what is your first grade teacher? ... 8675 ... no, I mean the teacher? ... yes, my answer is 8675" nonsense

Re: Ask HN: How do you manage your passwords in 2023?

#163

Post by snapplebobapple »

bitwarden for the everyday, lower value stuff, keepassxc on private storage for the more sensitive things like bank accounts, etc.

Once passbolt adds offline storage of a copy of the vault to their extensions I may switch to that as I am a big fan of their system, it is just annoying for a home gamer to find their internet is down and then going to log in to their router to fix it finding the password manager doesn't work.

Re: Ask HN: How do you manage your passwords in 2023?

#164

Post by worldsavior »

aidenscott2016 wrote: post #127
worldsavior wrote: post #123

Earlier quoted context omitted.

FYI, gpg is soon considered insecure, even now.

You can’t make a statement like that without clarifying what you mean and sharing some alternative to gpg

It's less about the algorithm, but more how gpg/pgp is constructed/used. No forward secrecy, leaks info, bad text authentication, and other. Those things maybe can be fixed, but they're not.

https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

Edit: an alternative for file encryption is age, fast simple and secure. Signing is signify.

Re: Ask HN: How do you manage your passwords in 2023?

#165

Post by worldsavior »

tmtvl wrote: post #131
worldsavior wrote: post #123

Earlier quoted context omitted.

FYI, gpg is soon considered insecure, even now.

What would you recommend, NaCl? Signify?

I would recommend using signify. That's what security researchers also recommend. Simple and elegant tool, designed to only signing, unlike gpg which is used for encrypting and signing as well.

Re: Ask HN: How do you manage your passwords in 2023?

#166

Post by ebfe1 »

acjohnson55 wrote: post #7

I use 1Password. It isn't perfect, but it's quite good. My big goal now is to come up with a better solution for 2FA that works for me and my wife's shared accounts.

I hope their desktop app is better now, last time i took a look, the whole vault is decrypted in memory and even when it timed out and request user for password, I was still able to inspect memory and retrieve the plaintext passwords

Re: Ask HN: How do you manage your passwords in 2023?

#168

Post by redsparrow »

princevegeta89 wrote: post #24

I'm all in on Bitwarden at this point. It's the place where I keep all my credit cards, secure notes and about a 500 logins. A vast majority of these logins have passwords generated by Bitwarden itself. I'm confident even if BW goes down I can still recover my data since the vault works offline too. While the browser extension could use some UX work the mobile apps have been top-notch and sharing passwords with my sp…

Speaking of the browser extension UX, for those who don't know, the keyboard shortcut for filling in your login details is ctrl-shift-L.

Re: Ask HN: How do you manage your passwords in 2023?

#169

Post by [deleted] »

worldsavior wrote: post #165
tmtvl wrote: post #131

Earlier quoted context omitted.

What would you recommend, NaCl? Signify?

I would recommend using signify. That's what security researchers also recommend. Simple and elegant tool, designed to only signing, unlike gpg which is used for encrypting and signing as well.

[deleted]
Post reply on HN