Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Ruggan
Feb 20, 2007
WHAT THAT SMELL LIKE?!


I currently use Strongbox and sync the password database between devices using Google Drive. It works ok, but sometimes my wife has sync issues and since she’s less techy I end up having to deal with it. Also the UI isn’t the best. But it’s free!

I’m looking at maybe moving to Bitwarden or 1password. But that probably also means paying a subscription fee. Anyone use these and have advice? Or have other recommendations?

Adbot
ADBOT LOVES YOU

HisMajestyBOB
Oct 21, 2010


College Slice
I use Keepass on windows, KeePassium on iPhone and MacPass on OSX, all using the same master file on Dropbox. This keeps them synced without a subscription and works well enough.

skooma512
Feb 8, 2012

You couldn't grok my race car, but you dug the roadside blur.
Bitwarden is cool and good and much less pushy about their subscription than Lastpass.

I pay for premium which is :10bux: a year. I could probably let the subscription lapse and it wouldn't affect my usage because I reviewed those just now and I don't really use any of those features, I just like their product.

Keetron
Sep 26, 2008

Check out my enormous testicles in my TFLC log!

1Password satisfied customer here, we have the family plan with some shared vaults to manage accounts more people need to access. I found it very easy in use and happy to pay for a product that improves my life.
Just take care to use .com or .eu depending on where you want your data to be stored.

eightysixed
Sep 23, 2004

I always tell the truth. Even when I lie.
Tossing in another vote for 1Password

Khizan
Jul 30, 2013


Another vote for 1Password here. I use it on my windows pc, android phone, and ipad with no issues syncing between them. It's worth paying for just so I don't have to deal with the hassle of keeping my own vault on dropbox or google drive or whatnot.

Pekinduck
May 10, 2008

HisMajestyBOB posted:

I use Keepass on windows, KeePassium on iPhone and MacPass on OSX, all using the same master file on Dropbox. This keeps them synced without a subscription and works well enough.

To my pleasant surprise Dropbox and Keepass play nice with each other.

ottergauze
Dec 11, 2022

Bitwarden gets my vote. Admittedly I considered 1Password briefly and it is amazing if you’re not all that technologically inclined, but i care about nerd poo poo like OPEN SOURCE and SELF HOSTING like a loving dork.

ottergauze fucked around with this message at 18:10 on Dec 11, 2022

Kyyrewyyoae
Jul 20, 2007

Vae debilibus!
Moved from LastPass to Bitwarden last year, seems great so far and I'm just using the free version.

SamDabbers
May 26, 2003



I can't believe nobody has mentioned the objectively best password manager, Excel. Password protected, of course.

Dans Macabre
Apr 24, 2004


I've been using 1password for many years. I never tried Bitwarden but heard great things. But 1password has been so consistently rock solid for me for so long that I have zero reason to switch. And I mean rock solid everywhere - web app, firefox, chrome, safari, macos, ios, ipados, windows, debian... I don't use the apple watch but they have some thing for it. Family plan works great.

Dans Macabre
Apr 24, 2004


SamDabbers posted:

I can't believe nobody has mentioned the objectively best password manager, Excel. Password protected, of course.

code:
=CHAR(RANDBETWEEN(65;90))&CHAR(RANDBETWEEN(97;122))&CHAR(RANDBETWEEN(97;122))&CHAR(RANDBETWEEN(65;90))&RANDBETWEEN(1000;9999)&CHAR(RANDBETWEEN(42;43))

QuarkJets
Sep 8, 2008

I use Google's password manager, it seems good

tinytort
Jun 10, 2013

Super healthy, super cheap
Another vote for 1Pass here. The sheer convenience is nice. I also sometimes use Google password manager, but I honestly don't trust it not to be selling my data somehow and I don't like giving all my logins to Google.

I know some password managers are free, but that makes me nervous. If I'm not paying them money for the service, then where are they getting the money to run it?

Douglas Legs
Nov 25, 2022

by Hand Knit
Bitwarden has my vote. It’s secure, it works easy. And you can run your own server for it, so evil actors in the cloud can’t touch it. That solves the problem of LastPass getting globally hacked, since you’re untouchable. The one problem I noticed is if your server goes down and you try to sync, it silently deletes your local changes. They might have fixed it by now, but it was annoying when I made some new accounts while setting it up for the first time, and lots of my stuff disappeared after a restart.

I’d avoid things like “Keepass”, specifically because of the name. I once heard of a guy who made a company reselling products from AliExpress for 20x the price, selling them as luxury items. And he put a hidden swear word in the name similarly to that. It makes me think any site or tool with a curse word is in there on purpose, and is an indicator that the creator is a parasite. So “KeepAss” sounds like it’s probably garbage. Another example of something like that is “Bitchute”. Sometimes they can be hard to spot too.

Back before password managers, I always used easy passwords. But still needed to use sticky notes because they were too hard to remember. I even put a sticky note next to my home alarm system keypad because it was too many digits. It wasn’t long until I discovered this sticky note idea was a prime no-no. I don’t know why they wanted a key code that’s longer than a phone number, but that’s what they did. And I did the prime no-no of placing a sticky note next to it with the pass code, because I didn’t know. The prime no-no is pretty obvious nowadays, but back then it was commonplace and lots of people regretted it. You'd see on the news people using computers, and a yellow Post-It has their password for hackers to get in and steal their My Documents folder full of bank information.

The prime no-no wreaked havoc on me one night when a man of malicious intent rang my doorbell over and over like he was playing ding dong ditch. He’s not very good at the game, because he was still there when I got to the door. I punched in the long long code in the keypad using the help of the sticky that was the cause of the prime no-no, and opened the door to find the man of malicious intent. I knew he was malicious, and it would soon be confirmed to me. First he asked if he could use my bathroom. But I knew that was bogus. Burglars look for any excuse to get in. Sometimes they bother you with questions to trick you into being nice to them. Like have you ever had a hobo walk up to you and ask “Can I ask you a question”? That’s literally to deceive you. If you say “yes” once to them, they’ll bother you and ask you for money. And psychologically, that first “yes” tricks you into thinking you have to keep saying “yes” to him. It’s known as a “Yes Ladder”, and I guess “The Benjamin Franklin effect” too. Check them out. They’re pretty interesting. And yes, it turns out he was a burglar. So don’t think I was being mean to a random guy who had to use the bathroom at 2am.

I said he can leave and told him that if he needs to drop stool he can on the neighbor’s yard. But not on mine, and not in my house. He begged and pleaded, but I could see the malevolence and hostility in his eyes. I said the second “No”. And he said “please it’s urgent I have to go”. This one was kind of convincing, but it’s lucky I didn’t believe him. I told him he can’t be here and he’s not allowed. I closed the door, armed the keypad, and walked upstairs to go back to bed. I didn’t expect the man of malicious intent to try breaking in. I should have, but I didn’t. He had gotten a very good view of the inside of my house, and I bet he could have seen that there was a sticky near the keypad that I was using as a password manager, which should have been the obvious indicator that something could happen.

I quickly nestled myself back to bed. About a minute after closing the door on the man, the alarm went off. Security alarms are loud and annoying and good at giving people permanent hearing damage. I opened my bedroom door and immediately got smacked in the face with a commanding stench. I looked to the stairwell and saw a looming dark smog flooding towards me. It was like someone set off a dark green smoke grenade in my home. Or that monster in the TV show “LOST” that probably no one remembers because the plot was so bad from the lazy egghead writers who keep writing “new” content instead of adding content that explains the previous episodes since they’re egghead morons who can’t tie their stories into a cohesive whole. I yelled at the shadowy hate to leave my home. No reaction. Only more murky billows fumed towards me and my innocent nose. I held my breath and pinched my nose to save it from the smell and ran downstairs. The man of malicious intent was passed out on the floor by the keypad. The fumes were emitting from his trousers, which had been stained the color of death.

It turns out he had broken in and attempted to turn off the keypad. But his stomach rumbles were too much for him. The demon seed’s painful burnings made him typo the keycode a few times. And before he could enter the last digit, satan’s spices ripped his crack clean apart and the senses of death invaded his pants. First, the sound of death alerted his ears of the incoming misery. The color of death stained his trousers. The touch of death gushed on his cheeks, down his thighs, shins, and feet, and streamed into his shoes and socks and punished the floor. The scent of death seared his nose with expert speed. The foul taste of death gagged him. He lost all air to breath and fainted in the grimy doom room which seconds ago was my pristine foyer.

A policeman eventually arrived. When I opened the door to talk to him, he frowned. He refused to help because of the devil’s smell and drove away so he could save his nose. I figured the pair of medics would be able to help though. They’re used to roadkill and all sorts of disgusting things. They put on oxygen tank masks to save their noses when carrying the burglar away, but you could still see the tears in their eyes.

The cops came back the next day to do a police report. They tell me I’m not to use sticky notes as a password manager and to memorize it instead. I tell them that's stupid and it’s hard to memorize long numbers. So I researched and use Bitwarden now for all passwords.

The insurance company determined the house was uninhabitable. They considered it an “act of god” and tried not to give me any insurance money. I told them to fung off and they needed to pay up. I told them I’d bring a bucket of the stink to their office if they tried to wimp out on their job. So they paid. Right into the bank account, which I secured using Bitwarden.








(USER WAS BANNED FOR THIS POST)

Ruggan
Feb 20, 2007
WHAT THAT SMELL LIKE?!


More like buttwarden

Hippie Hedgehog
Feb 19, 2007

Ever cuddled a hedgehog?
I use Keepass with one of the major cloud storage providers. It works, that's about all I can say.

The andoid app was good when I used it 3 years ago. The Firefox addon "kee" is decent but it's annoying to set up a browser add-on just to get password autofill. On iphone, I use Strongbox which is well compatible with the database and it works fine.

bees everywhere
Nov 19, 2002

I'm the best password manager. Give them to me and I will manage them for you.

Hippie Hedgehog
Feb 19, 2007

Ever cuddled a hedgehog?
Just in case someone comes across this thread in the year 2023, Lastpass is not the service you're looking for.

https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/ posted:


“Alerting and logging was enabled during these events, but did not immediately indicate the anomalous behavior that became clearer in retrospect during the investigation,” LastPass officials wrote. “Specifically, the threat actor was able to leverage valid credentials stolen from a senior DevOps engineer to access a shared cloud-storage environment, which initially made it difficult for investigators to differentiate between threat actor activity and ongoing legitimate activity.”

LastPass learned of the second incident from Amazon's warnings of anomalous behavior when the threat actor tried to use Cloud Identity and Access Management (IAM) roles to perform unauthorized activity.

Further Reading
Plex imposes password reset after hackers steal data for >15 million users
According to a person briefed on a private report from LastPass who spoke on the condition of anonymity, the media software package that was exploited on the employee’s home computer was Plex. Interestingly, Plex reported its own network intrusion on August 24, just 12 days after the second incident commenced.

So, also, don't expose your Plex to the internet.

Dans Macabre
Apr 24, 2004


hilarious

coconono
Aug 11, 2004

KISS ME KRIS

Hippie Hedgehog posted:

I use Keepass with one of the major cloud storage providers. It works, that's about all I can say.

The andoid app was good when I used it 3 years ago. The Firefox addon "kee" is decent but it's annoying to set up a browser add-on just to get password autofill. On iphone, I use Strongbox which is well compatible with the database and it works fine.

Same about KeePass. Its a local encrypted file, just let your cloud backup solution grab it. Share it with your friends and only open it in Read Only mode. The file is decently encrypted enough that if the poo poo was compromised, it'd take a national security entity to unravel its contents. And if they want it that drat bad, they can have it.

As for mobile devices, Apple's icloud is ok if you keep the 2factor stuff enabled and audit your devices and password list periodically. Yes blah blah Apple's been hit before and they're real bad about disclosure. So has every major cloud provider in some form or another. Manage your risk accordingly. Also I really like the automatic security alerting if a password has been exposed. Android has similar functionality but its hidden a few more menus down.

As a general rule, if its important enough to gently caress you over, enable 2factor. TBH, most of the poo poo I see in the wild is re-used passwords and targeting bruteforcing(with enough datapoints password guess can fall into statistical certainties). The security incident portion of my job decreased tenfold when we made 2factor a hard requirement for data access. If you're worried about sim cloning(yes you should be, its $45 and 5 minutes with an unattended phone), use email or a MFA app. Just make sure you look over your poo poo once in a while.

RPATDO_LAMD
Mar 22, 2013

🐘🪠🍆

Hippie Hedgehog posted:

Just in case someone comes across this thread in the year 2023, Lastpass is not the service you're looking for.

So, also, don't expose your Plex to the internet.

this is why you should use keepass instead of those "cloud" subscription services
it encrypts your password vault to a local file on your own hard drive without any corporate middle managers to inevitably gently caress everything up
you can sync the keepass vault on dropbox or google drive or whatever to share it between devices if you want, but the key thing here is that dropbox/google have no loving clue what's in the encrypted file and can't open it even if they want to because they're not the same company that runs the password service.
the android app works fine too, i've had no issues using it on desktop and phone

e: specifically I use KeepassXC with the firefox extension but I think all the forks use the same encryption and stuff, it's just slightly different UIs

RPATDO_LAMD fucked around with this message at 07:00 on Mar 20, 2023

olives black
Nov 24, 2017


LENIN.
STILL.
WON'T.
FUCK.
ME.

RPATDO_LAMD posted:

this is why you should use keepass instead of those "cloud" subscription services
it encrypts your password vault to a local file on your own hard drive without any corporate middle managers to inevitably gently caress everything up
you can sync the keepass vault on dropbox or google drive or whatever to share it between devices if you want, but the key thing here is that dropbox/google have no loving clue what's in the encrypted file and can't open it even if they want to because they're not the same company that runs the password service.
the android app works fine too, i've had no issues using it on desktop and phone

e: specifically I use KeepassXC with the firefox extension but I think all the forks use the same encryption and stuff, it's just slightly different UIs

:yeah:

Rhymenoserous
May 23, 2008
It should be noted that if you are using keypass or really any “on device password manager” to make sure you are laser focused on keeping it updated. The belief that it’s cryptography is military grade and not crackable ignores several documented vulnerabilities that have popped up with keypass in the past.

And yes I’m speaking from experience, one of our customers used keypass as their primary vault and bad actors had full access to all the keys to their kingdom. That was fun to deal with.

To be safe if you ever have reason to believe your PC keydb has landed in someone else’s hands it’s safest to treat any passwords in it as compromised as well.

Also mirroring what someone above said the emergence of 2FA has single handedly done away with 99.9% of the security bullshit I have to deal with.

Honj Steak
May 31, 2013

Hi there.
How safe is iCloud Keychain compared to the dedicated apps? I’ve never even considered anything else because I’m fully within the Apple ecosystem.

Internet Explorer
Jun 1, 2005





I'm a very happy user of 1Password and was actually just suggesting it to someone tonight. I don't think you can go wrong with Bitwarden, either. Do stay away from LastPass, though.

buglord
Jul 31, 2010

Cheating at a raffle? I sentence you to 1 year in jail! No! Two years! Three! Four! Five years! Ah! Ah! Ah! Ah!

Buglord

Internet Explorer posted:

I'm a very happy user of 1Password and was actually just suggesting it to someone tonight. I don't think you can go wrong with Bitwarden, either. Do stay away from LastPass, though.

Its kinda upsetting how good Lastpass' marketing is. They advertise everywhere and I even have an IRL friend who uses it. The only time I had password breaches was when I used Lastpass. Happy with 1Password here as well.

Sixtyforces
Aug 29, 2019

Where am I?
KeepassXC and a free MEGA account for Linux/Windows/Android.
Never had any issues with this set up.

Edit: There's also an extension for Firefox to autofill so long as you have your vault open.

flakeloaf
Feb 26, 2003

Still better than android clock

Honj Steak posted:

How safe is iCloud Keychain compared to the dedicated apps? I’ve never even considered anything else because I’m fully within the Apple ecosystem.

iCloud Keychain is perfectly fine.

Autofill features are only as trustworthy as the software's ability to tell which site you're trying to log into. Whether you use it to fill fields is all you, but I'll suggest you maybe don't allow a password manager to also submit those entries.

Adbot
ADBOT LOVES YOU

Seven Force
Nov 9, 2005

WARNING!

BOSS IS APPROACHING!!!

SEVEN FORCE

--ACTIONS--

SHITPOSTING

LOVE LOVE DANCING

Syncthing has been pretty good for me as far as syncing my database to my phone and I don't need to use someone else's cloud storage for it.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply