It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can't remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn't tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don't just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They're not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser's password storage is better than nothing. Don't reuse passwords, use long randomly generated ones.
It's free, it's convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I'm preaching to the choir, but if even one of you decides to use a password manager after this then it's an easy win.
Please, don't wait. If you aren't using a password manager right now, take a few minutes. You'll thank yourself later.
In my experience preaching this same thing to many users at work and just personal friends, they won't change their ways. Because "omg not another password to remember" and "that's too much work to login just to get a password".
I've just stopped trying to educate people at this point. That's on them when their info gets leaked or accounts drained.
People are already annoyed at base that they need any 2FA at all and don’t want to deal with more info. They just tune out.
Yup, they couldnt care less about any 2FA. But then they get the surprised Pikachu face when they get breached after being phished lol.
Tell them some password managers have TOTP support. I think I paid Bitwarden $10 for life or per year for TOTP so I don't need to use my phone.
That kinda defeats the purpose of 2fa though, if you use bitwarden for both
Instead of opening Google authenticator or Authy or whatever your preferred 2FA is, you can take photos of the QR codes in Bitwarden mobile to store the TOTP codes in it, and then Bitwarden puts them on your clipboard to paste into websites
you might have just inadvertedly sold me on bitwarden.
does it work with 3rd party sort of authentication apps? like when 2fa is inside the manufacturer app?
It works as long as you can get at the authentication key that generates the one time codes. Usually you scan a QR code, but sometimes you have to paste it in as a string.
How you get that private authentication key can vary by service. For example, you can install steam mobile on an android emulator and use an open source program to extract the private authentication key.
I am fighting this with people at work.
No, it is not "one more password to remember"
You have 2 passwords: your laptop and your Bitwarden. Forget everything else. Don't care. Use a passphrase if you have troubles with passwords.
I even generated a sample password from bitwarden and drew them a picture of how to remember it lol
Still about 10% of people forgot their password in the first 2 months.
My sell on password managers is quality of life. You never have to reset your passwords and you can use a hotkey to enter it faster than typing. Gone are the days of fat fingers.
But I get where people have an issue. It's one point of failure vs. many, but they don't realize It's easier to well secure the one than it is to not spread the same vulnerability everywhere.
Honestly as someone who has helped family members set up a password manager one person felt this way and the rest are just not tech savvy. All the simple straightforward stuff took ages because they had never done it before.
You are right. However most of the mainstream YouTubers promote rubbish password managers, which is why most people I know don't know about bitwarden. I usually recommend bitwarden or proton pass. (I'm self-hosting vaultwarden). More privacy focus YouTubers need to promote bitwarden, keepassxc etc. (I'm waiting for proton pass self-hosting option).
I self-host a lot of stuff. But password manager just feels risky to me. Like what if I mess up and lose all my data or something.
With bitwarden being encrypted and all I just didn't see any down side to using their server. Plus more convenient since I don't have to VPN to use it. Or open a port.
All of that just to ask. Am I missing something? Should I be self-hosting it? I wondered about using both so I'd have a backup ether way. Or in case their servers go down for awhile. But that's super rare.
It's free and fun for me. I wanted to learn docker and various networking stuff. For normal end users, I don't think there's any benefit like you pointed out
Been using 1Password for 6+ years and I probably won’t use anything else ever. My wife and I both use it and have a shared family vault for things we both use. I couldn’t live without a password manager.
Say, what are the chances either
- someone comes to depend on the password manager to get into their accounts, gets locked out of the password manager, and loses access to all their accounts (e.g. using the password manager to create and store passwords they might never have even seen);
or
- their password manager (or account) gets hacked, somehow, and all their accounts get taken at once
These are real issues however they are pretty easy to mitigate, and I would say that the upsides of a password manager far outweigh the downsides.
-
Make sure that you are regularly typing your master password for the first bit. After that you'll never forget it. You can also help them out by saving a copy of their master password for them at least until they are sure they have memorized it. There are also password managers where you can recovery your account as long as you have the keys cached on at least one device.
-
This is far, far outweighed by the risk of password reuse. This is because when a single one of the sites you use gets hacked then people will take that credential list and try it on every other site. So with a password manager there is just one target, without it is one of hundreds of sites where you reused your password. Many password managers also have end-to-end encryption so without your password the sync service can't be hacked (as it doesn't have access to your passwords).
Well, what if they somehow manage to get into my password manager account? I mean, it has a login, like any other account. The way to prevent it would be to have a strong enough password. Regardless, if they somehow got my main password, they'd have free access to all my credentials everywhere, and would be able to log into them as easily as I can. I mean, it is easier to secure one account well vs. however many others that the password manager can take care of. But still, a centralised hub with easy access to all my accounts feels like a one-stop shop for taking over my online life
I mean, to myself, I can deal with the consequences of my choices (as much as they can suck sometimes). But recommending stuff to other people I find complicated. I mean, I've gotten locked out of accounts due to 2fa (some being old and lost to time, others due to an unlucky series of events and a last minute half-assed backup) and even had to troubleshoot and/or reinstall (Linux) operating systems on my laptop (one instance of which relates to the aforementioned 2fa incident). To recommend something to someone and risk something like that, and be responsible for it… I mean, I once had to help troubleshoot a non-booting Linux machine via messages and photos during lunch out, and I myself am not an expert, so I had to online research from my phone and relay the information
These are all good points. This is why it is important to match your recommendations to the person. For example if I know they have Chrome and a Google account I might just recommend using that. Yes, it isn't end-to-end encrypted and Google isn't great for privacy but at least they are already managing logins over all of their devices.
In many cases perfect is the enemy of better. I would rather them use any password manager and unique passwords (even "a text file on their desktop") than them sticking to one password anywhere because other solutions are too complicated.
-
As Kramer said. Levels. If tou layer your security 2 becomes a non issue. What you have, what you know, and who you are. Which plays into 1. The 3-2-1 of backup. 3 copies of the data. 2 different media. At least 1 off site. Suprising as it might be, writing a great backup is to write your password down. I have a piece of paper with my password in a lock box in my apartment, in a safety deposit box at my bank, and at my parent's house
I blame the tinfoil hat infosec crowd for not understanding that the world they inhabit is not the same one Regular Users live in.
Is there risk in keeping all your passwords in one place, whether it's on your hardware or someone else's? hell yes! Is that risk stastically speaking ANYTHING LIKE the risk you take when you use 'pencil' for all your passwords because you can't be arsed to memorize anything more complex? OH HELL YES.
Sure, if you're defending against nation state level agressors, maybe using a password manager isn' the wisest choice, but for easily 99% of computer users, we're at the level of "keeping people from drooling on their shoes". So password managers are probably a GREAT idea.
I feel like password managers are more targeted to companies where sharing and controlling login data shouldnt be logged on some table in an excel sheet.
It just so happens that a manager is also god damn convenient for the private individualI don't think that's always the case. 1Password started out as a personal password manager and only added the corporate/teams/families features later.
I store my master password on a sticky note attached to the bottom of my desktop's power supply. Easily accessible if I were to die, but sufficiently secure that if it were physically compromised I would have significantly worse problems on my hands.
But I wanna tell people my master password to my pw manager. It's such a fantastic password that no one could ever possibly guess I would have. I wanna gloat.
Using Proton Pass was a game changer to me , I don't have to ignore the necessity to put a strong and complicated password for security reasons anymore, Proton generate it to me and stores everything ( so I don't need to remember which password I set for which account ) But the bad aspects of cloud services worry me a little about this: the possibility of a security breach of the service, or the possibility of not being able to access it for any reason is a real disaster if it happens... so I'm thinking of exporting my passwords to another safe place for such cases.
But the bad aspects of cloud services worry me a little about this
KeePassXC is entirely local.
I know , but won't that affect my storage if I added +1000 password ?
It shouldn't take up too much space. My personal password file is under 2 KB, so for you it may be 1 MB at most.
even if their servers were compromised it's all encrypted. it only decrypts on your end
so I’m thinking of exporting my passwords to another safe place for such cases.
I'm also using ProtonPass, and I agree it's a game changer. I love the interface, the Android app is amazing and well integrated.
To not be locked in into ProtonPass in case of real disaster, once a month I export the ProtonPass data and import to KeepassXC in my local machine. It's pretty easy, you just have to export to CSV, and import into KeepassXC, the interface will help you to map the CSV fields accordingly, and you will have a local accessible backup in case of disaster. Don't forget to remove the CSV from your computer after importing to KeepassXC.
Absolutely this. Been using KeePassDX for years and its made my life so much easier. I am waiting for it to support passkeys so i can start using them where possible.
Yes, but it's a bit involved to automate it. KeePassXC has a less technical recommendation here
That's what I've resorted to, but I only use Firefox because it has a master password.
Chrome has no master password so what stops any fool from stealing your passwords while you're taking a piss, I don't know.
Password managers always cause me headaches, though, and never want to integrate correctly. More trouble than their worth in my estimation.
Honestly nothing. I recommend this to everyone because it is the easiest way to set up and offers huge advantages.
- No more password reuse, per site random passwords.
- Auto-fill reduces chance of phishing attacks work because you get suspicious if the password doesn't auto-fill.
- Most browsers will integrate it into their sync service to reduce the risk of you losing your passwords.
I think these are the two biggest benefits and every browser password manager will accomplish both.
This is what I do: I use my browser to store all my randomly generated passwords. If I ever need them on my phone I either sync or go to my desktop and view the password and type it over.
I like using Bitwarden since it lets me input passwords for various apps on my phone as well as my other devices. Using one built into your browser seems fine as long as the passwords are stored securely.
