You must log in or register to comment.
Here’s the thing … as crazy as a notebook with passwords sounds, it’s not accessible to someone across the internet.
Password managers check the URL before giving its data. A human being can be fooled into giving it to a fake web site.
TBF, they can be fooled too.
Bitwarden warns against using autofill on load for that very reason, as then simply loading a malicious page might cause it to provide passwords to such a site.
And then, a human when a site doesn’t autofill, is more likely to just go “huh, weird” and do it manually.
You’ve always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something’s wrong and back away.
If you’re already used to manually typing in the auth details, you may not even notice you’re not on the site you were expecting.
Wait, what? How does autofill get fooled?
Someone manages to maliciously sneak username and password fields onto a site that store what is entered as soon as it’s typed. They don’t even have to be visible to the user and bitwarden will fill them in as soon as the page loads.
Bitwarden will only autofill if the domain matches.
Right, “maliciously sneak”, as in they’ve either gained access to make changes to the site ditectly, or they’ve found a way to inject their scripts to steal creds.
And how is that any different from not having a password manager?
Yes, if someone hijacks a domain they can get credentials intended for that domain. A password manager doesn’t make a huge difference here, because why would they make the site look any different than normal?
So… It’s a password book? Like, pen and paper?Not the best choice for storing passwords, but I’d be more willing to do that than trusting Amazon not to hold my passwords hostage with a digital service by them.
I’d rather people use this than reuse the same password everywhere.
Self hosted and air gapped.
Honestly, a physical password book isn’t a bad idea.
Not accessible via the internet, and in most cases if someone has physical access to your system you’re done for anyway.
The main weakness it has is from a nosey flatmate, spouse, or child in the house.
Yep. My Dad in his late 70s uses this system and it works great for him.
People make fun of it, but for people with low tech literacy this is actually far better than having a mish-mash of solutions where some their logins end up automatically saved in iOS on their phone, some are saved in Chrome on the desktop, some are just in their head, they don’t know where anything is, and are constantly losing access and resetting credentials all the time.
And it definitely reduces the burden on me of parental tech support, when its all in the book.
The main weakness it has is from a nosey flatmate, spouse, or child in the house.
I disagree. Using this book will always lead to shorter passwords that are easier to type. That’s the main weakness imo.
Or in other words: it really depends what the user fills it with. It should be accompanied by a little machine that spits out random passwords, I’m thinking a rubics-cube-shaped bling pendant at the end of the bookmark band.
Not at all. It will lead to easier to type passwords, likely. But that doesn’t mean shorter. This could easily be filled with passwords that are four words long with special characters interspersed.
I had one of these I got it around 15ya but I never used it. I remember liking a particular aspect of it as if I had a specific use-case in which it would be handy but I can’t remember what that was.
Keeepass, simple and easy to use! https://keepassxc.org/
i got bitwarden
Still better than using the same password everywhere and/or saving passwords in an unencrypted text file on your computer somewhere.
Just not very user friendly.
This isn’t the flex you think it is, OP. 99% of cybercriminals are also cowards. Physical security of ANY kind beats even the best password managers.
If you don’t know what lattice-based encryption is and how to purchase it through NordVPN, start reading up because encryption as we know it isn’t long for this world. Pretty sure they already dragged their feet too long on Bitcoin’s algorithm but the day cracking common ciphers is within the grasp of quantum clusters is the day we all become Amish. Plan accordingly!
Can’t wait to hand write my 32-bit passwords.
My understanding is that quantum competing has been taken into account for some modern cryptography. And that memory-hard cryptography basically defeats quantum computing solutions. There are a few methods, but one of them is just very long keys, it’s trivial to make a cryptographic key longer.
So sure, you could defeat some of that with a machine operating with 1024k entangled qbits, (which is… oh man… not an easy task), in which case, wow, congratulations. But what if I increase my key length to 100k? It might take an extra 3 seconds to check the key and log in, but it’ll take an extra 25 years for quantum computing to catch up.
Won’t longer key lengths increase the overhead for everything?
Yes and No.
Yes, everything increases in difficulty but the increases in difficulty are asymmetrical.
The difficulty of reversing a computation (e.g. reversing a hash or decrypting an encrypted message) grows much faster than just performing the computation (e.g. hashing a message or encrypting one).
That’s the basis for encryption to begin with.
It’s also why increasing the size of the problem (e.g. the size of the hash or the size of a private key) makes it harder to crack.
The threat posed by quantum computing is that it might be feasible to reverse much larger computations than it previously was. The caveat on that, however is that they have a hard limit of what problems they can solve based on the number of qbits they have.
So for example, let’s say you use RSA for encryption and someone builds a 1024 qbit quantum computer. All you have to do is increase your key size so that it would require 1025 qbits to crack, and then that quantum computer wouldn’t provide an attacker any benefit at all.
(Of course, they’d still be able to read your old messages, but that’s also a fundamental principle of cryptography; it only protects you for a period of time)
I would trust it more than the biometric payment method they’re pushing in Whole Foods
I should get this for my dad, he recently got a new computer at best buy and the geek squad told him his files were all in the cloud and sent him home. Guess who got a call the next day because “all my passwords are in a word document in some fucking cloud”. Yeah that was a fun day spent setting up his computer while listening to his rant about the geek squad and “the fucking cloud”… thanks geek squad…
As a software engineer who values humanity has done a good bit of work with “the cloud”, i think your dad has the right set of feelings towards the cloud. That fucking cloud can go get bent
Oh I agree but it would be nice if he’d have listened to me years ago and started using a password manager at least. I know he’ll never go full self hosting, but come on at least use Bitwarden!
Is it AI powered tho?
This isn’t even weird.
I think most security experts would recommend that you have your most important passwords written down somewhere, and then hopefully locked up in some safe or deposit box somewhere. You don’t need to buy an entire book for it, but some people like to spend money.
If this is for your less important passwords, then for the most part, writing them down is actually better. You won’t be as tempted to reuse your banking password for your social media. And some people like writing things down. A password manager is a better solution, but lots of people aren’t as good with technology and if they even let the browser remember it, they won’t know how to retrieve it later if they want to use a different computer, for example.
I have a letter in my safe in the event of my death that contains all my passwords and accounts. I have also slipped in a dead man switch that she’s unaware of that will wipe out my “collection of science”.
My password-manager is a script that gpg-decrypts to XDG_RUNTIME_DIR and then opens it in editor, encrypts back on changes. Is that bad?
How do you syncronize it between multiple devices and operating systems?
we might laugh at this but I think this is useful. Even though I wouldn’t use something like this and I’d just use a regular dedicated blank notebook and my password manager, it can be useful to people who have problems with computers and can’t handle a password manager, yet may give pages with good templates to show how to record sensitive information.
Or for folks that would be otherwise leaving logins and passwords in a clear text file on their desktop (glares at coworker). It’s still clear text, but at least it’s air gapped. It’s not for me, but it’s certainly for someone.
