Privacy@lemmy.mlbyThe 8232 Project@lemmy.ml
2 years

Use a password manager

It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can’t remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.

Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don’t just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They’re not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser’s password storage is better than nothing. Don’t reuse passwords, use long randomly generated ones.

It’s free, it’s convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I’m preaching to the choir, but if even one of you decides to use a password manager after this then it’s an easy win.

Please, don’t wait. If you aren’t using a password manager right now, take a few minutes. You’ll thank yourself later.

37
    • AbidanYre@lemmy.worldEnglish
      2 years

      One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account,

      To be fair, that is super fucking annoying. I hate when I tell bitwarden to save my password only to have the site come back with it being too long and only some special characters are allowed.

      • osanna@lemmy.vgEnglish
        1 month

        the crazy thing is, some websites will tell you that a 100 char password is “insecure” because it doesn’t contain numbers or symbols. Like holy shit.

      • floofloof@lemmy.caEnglish
        2 years

        My favorite is the sites that silently truncate your password to a maximum length only they know, before storing it. Then when you come back you have to guess which substring of your password they actually used before you can log in. Resetting doesn’t help unless you realize they’re doing this and use a short one.

    • root@lemmy.zipEnglish
      2 years

      In my experience preaching this same thing to many users at work and just personal friends, they won’t change their ways. Because “omg not another password to remember” and “that’s too much work to login just to get a password”.

      I’ve just stopped trying to educate people at this point. That’s on them when their info gets leaked or accounts drained.

      • zephorah@lemm.ee
        2 years

        People are already annoyed at base that they need any 2FA at all and don’t want to deal with more info. They just tune out.

        • Jessica@discuss.tchncs.de
          2 years

          Tell them some password managers have TOTP support. I think I paid Bitwarden $10 for life or per year for TOTP so I don’t need to use my phone.

          • morrowind@lemmy.ml
            2 years

            That kinda defeats the purpose of 2fa though, if you use bitwarden for both

            • Jessica@discuss.tchncs.de
              2 years

              Instead of opening Google authenticator or Authy or whatever your preferred 2FA is, you can take photos of the QR codes in Bitwarden mobile to store the TOTP codes in it, and then Bitwarden puts them on your clipboard to paste into websites

    • mechap@lemmy.ml
      2 years

      Whatever solution you think you can come up with is most likely not secure.

      Having my passwords written down on a piece of paper is not safe ?

      • EuroNutellaMan@lemmy.world
        2 years

        No. Anyone near you or with access to your place can see it. And most people know of the tricks.

        Also you can’t encrypt it and most of all you can’t really generate as strong passwords as those generated by password managers, meaning I don’t even need the paper to try and crack your password

        • Eunie@feddit.org
          2 years

          you can’t encrypt it

          My friend, you will be surprised that encryption is something that not only the magical internet machine can do.

          • EuroNutellaMan@lemmy.world
            2 years

            It’s still nowhere near as secure and convenient as using an appropriate tool. You will either have one that is easy to decipher and remember or one that is hard to decipher and remember. And you have to do it every time but at that point you might aswell just remember one password/passphrase and use it for your password manager, defeating the whole point.

            Also bare in mind convenience is important in security, if a measure is very inconvenient you will eventually just bypass it on your own cause you can’t be arsed.

    • Interstellar_1@lemmy.blahaj.zone
      2 years

      My dad somehow believes that that password managers are very insecure ( he got that from some sort of ‘reputable source’, so me telling him bitwarden is secure doesn’t help) and he just writes down all of his completely randomly generated passwords in a notebook, which always seems really inefficient to me, especially when he writes a character down incorrectly.

      • superkret@feddit.org
        2 years

        He’s doing something right.
        You can’t hack a paper note over the internet.

    • far_university190@feddit.orgEnglish
      2 years

      Is there manager than create password based on masterpassword and domain/username? Do not want to lose all password just because drive dies. Do NOT want to use cloud anywhere.

      • lseif@sopuli.xyz
        2 years

        backups backups backups.

        keep a copy on your computer, your phone, and every spare drive u have in the house. ask a friend to store the file at their place.

        also, whats wrong with a cloud provider, if the file is encrypted ?

          • qqq@lemmy.world
            2 years

            This is not true at all. https://en.wikipedia.org/wiki/Post-quantum_cryptography good place to start if you’re genuinely interested. Most password managers that are worth while will be using symmetric cryptography which just requires longer key lengths to survive in the quantum age. AES256 should be fine for the foreseeable future.

          • Redex@lemmy.world
            2 years

            I mean, you can change your passwords later on if you think a quantum computer broke them. In the case of quantum computers your network traffic is also gonna get cracked anyways, so they can steal your account information through that as well.

    • Ashen@sh.itjust.works
      2 years

      Quick question - what are your opinions on using Firefox’s inbuilt password manager? I’ve installed Bitwarden as an extension, but I find Firefox to be more convenient.

      I mostly use FF on Linux, Windows, and Android and have no issues with using FF cross platforms.

    • jsomae@lemmy.ml
      2 years

      is it possible to sync keepassxc between computers + phone?

        • renzev@lemmy.worldEnglish
          2 years

          You can lock your password database with a key file (this is a standard feature in keepassxc) and transfer the key file once between devices via sneakernet (microsd or usb drive). That way even if someone intercepts your database file, AND knows your password, it is still virtually impossible to crack. Should be a good enough solution, unless you are quantum-tier paranoid

      • The Cuuuuube@beehaw.orgEnglish
        2 years

        In-built password managers for browsers are straightforward to crack. Like… Terrifyingly easy. It’s much better to use something like Bitwarden, Vaultwarden if you don’t trust Bitwarden, 1Password if you really want the reassurance of paying someone for trust, or KeePass if you don’t trust anyone at all (I, personally, fit into this category).

        • zeh_ahoi@lemmy.mlEnglish
          2 years

          show me an example of the firefox password manager being “cracked”. i mean i still sync them into my local nextcloud. @[email protected] suggests it is cool to have your passwords in a file?!

          doubt there is a scenario where using MORE services makes anything safer. Well maybe for Windows Users…but thats a dying species with the win11 crap.

          so no. third party corpos…the worst.

    • unrushed233@lemmings.world
      2 years

      Using 2FA on all accounts that offer it is just as important. And make sure to use a good, open-source TOTP client like Aegis on Android or Tofu on iOS.

      Definitely make sure to backup your seeds in an encrypted format (e.g. Veracrypt container or GPG-encrypted files). If you lose your seeds, you lose access to your accounts.
      I like to use the automatic backup feature in Aegis, which syncs my encrypted vault to my Nextcloud server. You can also enable compatibility with Android’s backup API and use that if your ROM includes a backup solution like Seedvault.

            • osanna@lemmy.vgEnglish
              1 month

              I know I’m 2 years late, but if they get access to your password vault and you have your TOTP in your password vault, they get access to your accounts. It’s a VERY bad idea to put your TOTP and passwords together. it pretty much defeats the point of TOTP.