61–70 of 179 posts
I switched from LastPass to Bitwarden. I'm still not even 1/3 the way through from changing all my passwords and OTP tokens (Obviously I changed bank passwords, etc, right away.)
Bitwarden is secured with my yubikey, with a 2FA code in another Authenticator app. Then, all my other OTP codes are within Bitwarden. For $10 a year, I am very happy with the service.
Earlier quoted context omitted.
My setup too. However, this year I would like to give a go to self hosted Bitwarden in a RaspberryPi. Just for the satisfaction of it.
Just commented about my setup here: https://news.ycombinator.com/item?id=34207417 :D. Definitely worth the slight effort, for all the gains.
Bitwarden clients really provide ease of use and I use it in combination with a Selfhosted bitwarden server called vaultwarden.
I roll my own. I use emacs on an encrypted password file stored on my local PC.
How do you keep the password file encrypted on file write and file open? Do you decrypt to the file system to a temp file first? Thank you
That's one of the nice things about common/basic/widespread standards and tools: good compatibility and support.
Handling non-GPG encryption in a similar way should be possible too, but won't work out of the box.
Smartcard and WebAuthn support are on the roadmap. Doing also a lot of modernization on the next weeks. https://github.com/tejado/Authorizer
Firefox. It's not perfect especially on Android (I have to manually copy the password instead of it auto-filling) but it's good enough.
have you tried firefox sync? recently gave it a try and on android it works seamlessly. Cross browser integration is an extra step though.
One of my major goals for 2023 is to migrate as much as feasible from passwords to tokens or at least passkeys. NitroKeys or YubiKeys for that. Process has already begun, but I definitely hope to see that accelerate big time (at long, long last) this year. Feels like there is serious industry momentum from the big players this time, and that cost, UX, support in frameworks to make it easy for non-sec webdevs, may all…
I have over 1,000 logins in Bitwarden. I got a new Yubikey last year and found maybe a dozen sites which support it. I hope this is the year that WebAuthN goes mainstream - but it'll be a long time before a plurality of sites support it.
Oh for sure, like I said passwords will undoubtedly have a long tail. Even more so for internal apps/hardware, I routinely deal with old stuff that I have to keep old browsers around to access since newer ones no longer will work, or reenable old SSH negotiation or whatever. I'm just hoping 2023 is when we start to see a critical mass, and further that it ends up being a non-linear adoption curve that goes better then we might expect. If it becomes a standard check box item for insurance or security assessments or interacting with other companies/government and gets integrated as default into widely used frameworks it might go quicker. I also expect adoption not to be randomly distributed, with important tech services more likely to pick it up or use it already. If financial and medical does as well then that'd hit a lot of the most vital ones even if it's not a plurality.
Realistically it'll probably take another few years after hitting the tipping point to truly ramp, since there are clearly remaining hardware and software rough edges to sand down/refine. But if 2023 proves the start of an S-curve I'll be happy.