21–30 of 77 posts
> why don't people use local password managers? I do use a local password manager, personally. The disadvantage to doing so is that I don't get autofill of passwords and have to enter them by hand. I consider that a good thing, though, because it means that I end up memorizing the 3 or 4 passwords I use the most in a couple of days after generating them.
> Obviously, this would be less convinient and wouldn't sync between devices. But would do the job. Something that does not sync between devices does not do the job.
I have many devices, and many passwords. Using a cloud sync password manager allows me to follow best practices in having complex, unique passwords for each account. Data breaches and password leaks at random websites are a much more common attack vector than all of your encrypted passwords being exposed via a password manager. > Through these hackers can generally get passwords of all users of these services I'm not…
In the early days they did not set a minimum length and they did not increase users settings once it became clear it wasn’t enough.
> why don't people use local password managers? I do use a local password manager, personally. The disadvantage to doing so is that I don't get autofill of passwords and have to enter them by hand. I consider that a good thing, though, because it means that I end up memorizing the 3 or 4 passwords I use the most in a couple of days after generating them.
KeepassXC has auto-type
So I use a standalone password manager on my phone instead.
I have no idea.
I use a locally encrypted store, and have done so for almost 10 years. I keep thinking to myself "there's got to be something better, surely I could make an external device..." but it remains to be seen.
* Syncs between devices. I can login to my accounts in all my devices. If I can access my Dropbox account, I can access everything else with the master password.
* Auto password generation. I don't ever even bother looking at the passwords. Just generate something like 32 characters with all ASCII characters, including "special" characters. This goes a long way.
Having used KeePass (with Dropbox sync) since ~2018 I don't even know how people operate without a password manager. It's so intensely convenient. Just dump all the info in the database. I can even take notes in my database. Write my credit card number, SSN, other private info. Put SSH keys. Put website info. Describe where I put my tax documents. Password manager is a pointer to everything else.
> why don't people use local password managers? I do use a local password manager, personally. The disadvantage to doing so is that I don't get autofill of passwords and have to enter them by hand. I consider that a good thing, though, because it means that I end up memorizing the 3 or 4 passwords I use the most in a couple of days after generating them.
I had a phishing attack against me prevented by a password-manager; I ended up at a pixel-perfect copy of the login-page, with the domain of original link I clicked on being correct (it used an existing URL redirector on the original domain). It wouldn't auto-fill, so I looked at the address bar and gasped.
Keepass has nice clients but some require bringing my own sync(syncthing frequently failed due to conflicts) and some apps went out of maintenance. Some supported ones like dropbox/gdrive but frequently broke integration every other month due to api changes. Also, when I want to use 2FA, a basic synced encrypted file doesn’t work and having 2-3 apps(most standalone OTP apps needs my phone number or email or credit card) scattered between different platform. Basically after 10-15 credentials, it becomes maintenance headache.
What the likes of 1Password/Bitwarden/Lastpass(naughty naughty …) does is, they provide ubiquitous experience on all of my devices and seamlessly does the sync for a very little price(bitwarden 1year is only €10/-, that is dirt cheap compared to one falafel bread cost me €6+) removing all of the maintenance and management headache.
As for security, I would trust bitwarden or 1Password more than random unmaintained keepass app with self managed syncing and random loss(fixing sync conflict on a keepass db is super risky domain of severe data loss!). Also it is their business to manage my passwords and if hackers are harvesting passwords easily from them, what makes you think that hackers can’t do that on the very website that you enter your credit card details?
Password managers are major improvement in quality of life and security. Heck, I don’t even know 99% of my password, I just click generate and autofill without having to think about all arcane 1 uppercase, one special digital rules on different websites.
—EOR—