It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can’t remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don’t just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They’re not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser’s password storage is better than nothing. Don’t reuse passwords, use long randomly generated ones.
It’s free, it’s convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I’m preaching to the choir, but if even one of you decides to use a password manager after this then it’s an easy win.
Please, don’t wait. If you aren’t using a password manager right now, take a few minutes. You’ll thank yourself later.
One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account,
To be fair, that is super fucking annoying. I hate when I tell bitwarden to save my password only to have the site come back with it being too long and only some special characters are allowed.
Clarification: They reuse the same password (such as “Password”) and whenever they create an account they have to add special characters (like “Password1&” if numbers and #@&%$ were required) and when they login they forget which special characters were required by that service, meaning they don’t know which special characters to append to their generic password to successfully login. The solution was to screenshot every password requirement for every service and still try to remember which characters were used.
But yes, there is an unrelated frustration where password requirements aren’t presented upfront.
But yes, there is an unrelated frustration where password requirements aren’t presented upfront.
And pinnacle of this frustration is “password too long”… Talk about security
which doesn’t make sense as a requirement, as the passwords themselves are not even (supposed to be) stored
limits of 128+ characters? Sure.
Limits of 30, 20, 18, or 16 as I’ve seen in many places? I suddenly don’t trust your website.
Do you want to know the kicker? There are banks (yes, you heard me right) that straight up don’t allow more than 20 chars. 20!!! And they say you got to use the app for X things because it’s secure and shit (e.g.: use the app to 2FA credit card transactions). Meanwhile, does not allow you to add a yubikey for Fido authentication
Steam and Spotify are notorious for this.
My sell on password managers is quality of life. You never have to reset your passwords and you can use a hotkey to enter it faster than typing. Gone are the days of fat fingers.
But I get where people have an issue. It’s one point of failure vs. many, but they don’t realize It’s easier to well secure the one than it is to not spread the same vulnerability everywhere.
Honestly as someone who has helped family members set up a password manager one person felt this way and the rest are just not tech savvy. All the simple straightforward stuff took ages because they had never done it before.
You are right. However most of the mainstream YouTubers promote rubbish password managers, which is why most people I know don’t know about bitwarden. I usually recommend bitwarden or proton pass. (I’m self-hosting vaultwarden). More privacy focus YouTubers need to promote bitwarden, keepassxc etc. (I’m waiting for proton pass self-hosting option).
whats missing, since the proton pass source code is available?
I was in the US Air Force for 20 years, working as an IT guy, and our computers were so locked down, you couldn’t use password managers at work. Nor were you allowed to bring them in.
Almost every office I worked in was secured; no removable electronic devices allowed. No cell phones, no flash drives or removable drives. Heck, CDs were a controlled item. You had to check with a security manager for approval before bringing in a music CD, and and data CDs required a log of their use and physical control by a trusted agent.
Plus, the computers themselves had a custom-configured OS and you couldn’t install any software on them that wasn’t on a pre-approved list. Half the time, normal users needed to talk to an admin like me to install something, and I might not even have the rights at my level to do it.
I didn’t get to mess around with password managers until I retired a couple years ago, and they’ve been a game changer! In the military, we needed unique complex passwords for everything, can’t reuse passwords, can’t write down passwords, and you had to change them every 60 days.
Having a password manager makes my personal accounts so much more secure. I can have super complex passwords for everything and not need to remember them. I currently have Proton Pass (been de-Googling my life and switching all my stuff over to Proton lately) and it’s been wonderful.
I don’t know why the military doesn’t get some sort of password manager approved for use. This is far more secure than what they’ve been doing in the past. I had 3 standard password templates, then made minor changes to them for every unique account. If they got too complex, I’d forget them (and again, we weren’t allowed to write them down). Now I can just auto-generate a 25+ character complex password and I don’t even need to remember it. I love it!
This is crazy to read, thanks for sharing! How did you store/remember all the passwords?
I have a password manager with a family plan so my wife can use it. Does she? Absolutely not. And that’s why we don’t share bank accounts.
Same and she has the balls to ask me for passwords!
I’ve been using Proton Pass and it has been a game changer for me. Hot take: I think Proton Pass is Proton’s best service.
It creates not only a unique password for each service but also a unique email address alias. If a website leaks my email address and I get spam, I know exactly who did it and I only need to swap 1 login credential.
Has a built-in 2FA and passkeys. Works great in the browser with proper auto complete, even for the 2FA code. Works fine on Android and password in both browser and applications get autocomplete.
Proton Pass can be used by everyone, regardless of their technical level, in every device. My mom could easily use this across all her devices. I’m told Keepass is fantastic but having it sync across all her devices would be challenging for her.
Most Proton services feel kinda underbaked but Proton Pass is excellent.
I’m a little miffed that 2FA support is a paid feature.
I’m using KeePassXC and have no intention of switching, plus I’m paying for an account anyway, I just feel that 2FA is such an essential feature for a password manager that it shouldn’t be locked behind a paywall.100% agree. Charging for the unlimited email alias is fine but 2FA? :/
If that wasn’t a scripted ad, you should go into sales.
I have worked in retail to help pay for university. It was a miserable job. Dealing with people made me a worse person.
I am very “passionate” about Proton Pass but don’t take me for a Proton chill, I have a lot of criticism about their other products.
I actually came here to echo this exact sentiment. I was on Lastpass until their first breach and then on Bitwarden both cloud and self-hosted until a few months ago when I set up with Proton. I liked Bitwarden so I put off trying ProtonPass. One weekend I set it up and ended up putting my 2FA items in as well. It feels absolutely seamless to use. The email aliasing for websites is so easy for making new website accounts. In my desktop and laptop browser the way it automatically offers to autofill the 2FA is so clean. I can’t see myself going back unless Proton gets prohibitively more expensive or the product declines in usability/security. If you are currently using Proton’s suite of apps give Protonpass a try. You can easily import from Last pass/Bitwarden and use both to compare side by side.
Been using Bitwarden for a couple years now…
No regrets
I blame the tinfoil hat infosec crowd for not understanding that the world they inhabit is not the same one Regular Users live in.
Is there risk in keeping all your passwords in one place, whether it’s on your hardware or someone else’s? hell yes! Is that risk stastically speaking ANYTHING LIKE the risk you take when you use ‘pencil’ for all your passwords because you can’t be arsed to memorize anything more complex? OH HELL YES.
Sure, if you’re defending against nation state level agressors, maybe using a password manager isn’ the wisest choice, but for easily 99% of computer users, we’re at the level of “keeping people from drooling on their shoes”. So password managers are probably a GREAT idea.
I feel like password managers are more targeted to companies where sharing and controlling login data shouldnt be logged on some table in an excel sheet.
It just so happens that a manager is also god damn convenient for the private individualI don’t think that’s always the case. 1Password started out as a personal password manager and only added the corporate/teams/families features later.
is it possible to sync keepassxc between computers + phone?
Syncthing has worked well for me between 3 devices(Linux, android, windows). I’ve had one conflict in 6mo and it was easy to identify the right copy to select in keepass’ prompt since the more recent one was a larger file.
Synchthing also provides optional version control which makes backing up easy.
Yes, but it’s a bit involved to automate it. KeePassXC has a less technical recommendation here
A long time ago, I used Syncthing to do this. Sometimes there would be file conflicts, which was a pain to resolve, so I switched to BitWarden (using their server for syncing) and have been using it ever since.
You can keep the database on a device accessable by all of your other devices. I’m sure there are many other solutions but that’s worked for me over the years.
Quick question - what are your opinions on using Firefox’s inbuilt password manager? I’ve installed Bitwarden as an extension, but I find Firefox to be more convenient.
I mostly use FF on Linux, Windows, and Android and have no issues with using FF cross platforms.
I’m in the same boat. FF is just too damn convenient
Yeah, the used to have the lockwise app, which was awesome, I don’t know why they scrapped it
While it’s so convenient, anyone gaining access to your browser while your laptop is open can gain access to everything. Bitwarden usually add an extra step to unlock it (which you could disable if you want) when you want to use the extension. By the way, it has an extension for Firefox, so just hitting Ctrl + Shift + L it auto-fills the login/password fields of your login page just like firefox would. But with the extra step that gaining access to the browser doesn’t straight away unlock all your passwords for anyone to see.
Firefox has an option to set a master password, doesn’t it?
It does
I use bitwarden over Firefox because it can auto fill into apps. So, my bank apps or whatever else. And I’m not tied to Firefox if, for some reason, I want to stop using it.
It’s similar to why I don’t use Samsung pass on my phone. It’d work better filling in the fields, but that’s not going to help me on my PC, and I don’t want to maintain multiple managers.
It does work with apps on Android, you just need to replace the default system password manager with it. Although my bank does use a complicated password system that cannot be used by password managers.
And I’m not tied to Firefox if, for some reason, I want to stop using it.
Not gonna happen.
At this point, probably not. But, at one time, I did leave Firefox for Chrome when it was new.
I mean I used to say the same but then I did after doing more research in mozilla’s privacy things. Also Ladybird is coming at some point and frankly can’t wait for that
Firefox password manager is brilliant, my move to Bitwarden wasn’t worth it and I regret it.
I’d be open to using a pw manager then I read the comments here and everyone is suggesting different apps, arguing over how inconvenient one or the other it, various issues, etc. It doesn’t make me feel like taking action if everything feels sketchy.
I just tried the free option (bitwarden) and then migrated to Proton to use all of their apps. TOTP support is also an added bonus for the Proton Pass since Authy has fucked off a cliff.
What happened with Authy? (As someone who uses it)
I think you might be preaching to the choir here.
Circlejerkin on lemmy is our mutual hobby here
I migrated to Bitwarden from Firefox a few months ago and I regret it as it’s slower and inconvenient while not adding any major features. So yes, use a password manager and the one provided by Firefox is perfect for almost everyone.
How is it more inconventient and slower?
The only reason should be that it needs to decrypt the vault upon login which (depending on the iterators of the encryption and the processing speed of the system) can take a second more. Until then it’s equal to a native integration.
Upside: You are not locked to a browser anymore as (at least Bitwarden) is agnostic.On android, there’s a 4 second lag to get the fingerprint reader ready, 0 with Firefox.
I’m not going to switch from Firefox anytime soon but it’s super easy to export passwords and the Firefox password manager works for any apps on Android.
I also use Firefox on Android with a fairly recent stock ROM phone. At best the whole process to pasting my password into the webform takes 5 seconds.
If the vault is still within unlock period the auto-fill takes even less time (assuming the authentication URL regex is correct. It’s a bit annoying with subdomains)
I agree, but I just know that someday Mozilla is going to go down and I’m gonna lose my passwords and I won’t even be able to get into my email to reset them.
The passwords are stored locally. You can test this yourself by turning off your WiFi or disconnecting your Ethernet cable and then going to about:logins. All the passwords will still be there.
You can (and probably should) backup your passwords. Same goes for any hosted solution.
I’ve been using Firefox’s built in password store, plus 2fa for sensitive accounts when possible. Are there any known issues? Uploading all my passwords to someone else’s server sounds silly.
Uploading all my passwords to someone else’s server sounds silly.
KeePassXC is entirely local.
Are there any known issues?
LastPass (ironically) explains this best: https://blog.lastpass.com/posts/2022/06/why-you-shouldnt-store-passwords-in-a-browser
Thanks but the LastPass article is partly inapplicable and partly marketing. The one good point it makes for non-corporate users is about leaving your browser open where attackers can access it, say at the office. For a while I tried using a FIDO2 token but they weren’t well enough supported at the time. Maybe that is easier now.
I guess the reasons I would make would be not all accounts are web-based, and using a browser for anything other than browsing is a bad idea. Browsers aren’t exactly focused on keeping passwords safe, so why not use a tool designed for it? Don’t keep all your eggs in one basket
P.S. Yes, FIDO2 is much more supported
I guess I use a few APIs with auth tokens that are like passwords but I don’t see how a password manager would help. Yeah the tech for this stuff could be better, but vendors keep messing it up.
What about your Lemmy account?
On my laptop I use the Firefox password store. On my phone I mostly use Voyager which presumably stores the password in a protected app file. It could probably be extracted by rooting the phone but that has gotten harder to do, and anyway it’s also in Firefox on the same phone. Voyager is basically an API client. I can see some interesting ways to improve this but haven’t cared enough.
If you’re on Linux and you don’t want to use KeepassXC, you can check out Secrets on Flathub, it has imo a better UI/UX
If you’re on Linux and you like minimalism, pass is also a great option
Interesting, thanks for the recommendation.
