Default macOS/iOS password manager. Chrome doesn't use it, but everything else does.
There is an official Chrome extension: https://chrome.google.com/webstore/detail/icloud-passwords/p...
Seems to be rated very low
Ask HN: How do you manage your passwords in 2023?
171–179 of 179 posts
Re: Ask HN: How do you manage your passwords in 2023?
#172I just do it the old-fashioned way: memorisation.
I feel that you either have the best memory on earth, live offline and need to memorize only a couple of passwords, or you are doing something wrong (like using the same password over multiple services)
Re: Ask HN: How do you manage your passwords in 2023?
#173Earlier quoted context omitted.
I haven't been, but I should look into it. But the shared accounts that are my pain point only offer SMS OTP.
I had this same issue. Use a shared vault with OTP. Anyone with access to the vault can see the same 2FA code. As for shared SMS, look into Google Voice. They automatically forward SMS texts to email as an option. I created a "shared" email account and gave my family access to that.
A lot of sites won't allow you to use a Google Voice number for your 2FA. There are services now that will validate if a number is VOIP, and then the site you're on can choose to filter those at the application level.
I did find a way around this, in that I had a real number, added all my 2FA accounts to it, and then ported the number to Google Voice, but this isn't a long term solution. Idk how long Google Voice will stick around, but I have found a couple backup options that are low cost if I need to keep the number long term.
Re: Ask HN: How do you manage your passwords in 2023?
#174Hash of a salt stored in my brain unlocks the password vault.
This doesn’t work well on mobile though since hashed aren’t typable.
One of my New Years todos today is to set up a mnemonic for my phone.
That, paired with disappearing messages and making individual apps require a touchID will make it very difficult for folks to be… nebby.
Biometrics are easy to spoof or steal, whereas a fourteen digit mnemonic of the Shakespeare lines you used to quote will be easy to type, easy to remember, and take years and/or a Targeted effort to crack.
(Also I hope it goes without saying that nothing from Bill ever unlocked my box - examples are fictionalized.)
Re: Ask HN: How do you manage your passwords in 2023?
#175Earlier quoted context omitted.
Without a security background, it’s hard to evaluate whether what you are doing is secure or not. You don’t know what you don’t know; unknown unknowns etc
This is a valid point. I feel savvy with a lot of things but this is not an area where I'm willing to take risks.
Given that the cloud password managers are much bigger targets, self-hosting may actually lower your risk.
Re: Ask HN: How do you manage your passwords in 2023?
#176Earlier quoted context omitted.
1Password with shared vaults and OTP fields works well for this. I understand the idea of putting both factors in one place is odd, but I feel it strikes the right balance between the convenience and security.
> the idea of putting both factors in one place is odd This is AKA "one factor", right?
Sort of.
TOTP MFA is crap anyway because it has no passcode and it is so trivial to sync and it’s common for people to do so. So in scenarios where people close to you are a risk, or you’re dealing with other peoples data, it’s pretty weak control. It’s great for preventing spray attacks and mitigating some compromise scenarios.
It’s likely members of your household, friends, coworkers have access to shared devices or shared vaults in 1Password. That makes that type of MFA more like 1.5 factor vs 2 factor.
Re: Ask HN: How do you manage your passwords in 2023?
#177If you have a Mac use keychain. I never understood why Mac users use external tools.. I mean really? Why? Perhaps if you manage a team at work ok.. but single user subscriptions? For Linux and windows i would use keepassx.
It’s a legacy OSX component that exists by the grace of benign neglect. Apple will suddenly “fix” it someday.
Re: Ask HN: How do you manage your passwords in 2023?
#178Earlier quoted context omitted.
1Password with shared vaults and OTP fields works well for this. I understand the idea of putting both factors in one place is odd, but I feel it strikes the right balance between the convenience and security.
> the idea of putting both factors in one place is odd This is AKA "one factor", right?
1Pasword is itself a two factor app. The password is something you know and the secret key is something you have. Definitely counter-intuitive, but like how your operating system can contain both your password and your 2FA app, or your desk can contain your computer and your hardware key.
Whether you want to be one bad front-end UI deployment away from both factors being exposed, fair question...
Re: Ask HN: How do you manage your passwords in 2023?
#179Since I'm using all Apple devices after a short foray with 1Password I've switched to an app called Strongbox on macOS and iOS. It's the only app I know of that uses Apple's AutoFill API on macOS and thus works without any extension in Safari and feels like the native Keychain.
On top of that, it supports syncing the database via iCloud, WebDAV, SFTP, Dropbox and a few other services. And it uses a bog standard KeePass2 database for storage, so you can use it with KeePassXC on Windows or any other KP2-compatible app. This also means that there's always a way to get to your data should Strongbox disappear.