re: Anyone using a password manager?

I have 1291 unique entries in my BitWarden vault. If you *can* use a spreadsheet to keep track of passwords, your passwords aren't unique enough. Besides, you need something to generate a key for MFA anyway.

quote:

---

With as cheap as usb thumb drives are now, there’s no reason not to have a safe and just chuck 1 in there every year.

Never know when it will save your butt.

---

How does a USB drive provide password security?

I use 1password. I've never used anything else, but I don't have any complaints with 1password. One of the benefits to me besides basic password management is that my wife knows how to use it, so I don't worry about something happening to me and her not being able to easily get into things.

I also add MFA to anything that allows it, typically via Microsoft Authenticator.

Because it's not hackable unless someone steals your USB drive or hacks your particular PC. The "fear" is that a central database that stores passwords can (and will) be hacked. Therefore, keeping passwords local on encrypted devices is more safe. The question was, "do you have a backup"? My comment was that as cheap as thumb drives have become it makes sense to buy several of them and just backup the data every so often and keep it in a safe. These files are not that large.

1Password

Worth every penny.

1Password

quote:

---

One question, when you start with a password manager, how does it interact with existing passwords on websites you already have setup. So for example, you have a login to Amazon already, does the password manager let you add amazon, and then it updates your password automatically to their secure format, or do you have to manually update each one you have?

---

I haven't tried this, but it looks like Bitwarden can import credentials that you have stored via your browser.

Import from Firefox

Dashlane

quote:

---

Been trying for a while to get my wife onboard, but when it comes to technology, she would rather just burry her head in the sand until she's forced to use it.

---

Problem here is a lot of people don't feel "forced" to use a password manager until something bad happens.

quote:

---

Funny thing is one of her concerns about a password manager site is if someone hacks them, they will have all of her passwords. So, she stores them in her google contacts list

---

Much, much, MUCH more likely to have passwords stolen from your contacts app than from a password manager site, especially if the contacts are synced across devices (so they are stored in the cloud possibly in plaintext). How many apps have permissions to access contacts on her phone? Probably a lot.

quote:

---

not the exact password, she at least uses a code system

---

That just makes it impossible to autofill passwords, which is a necessity if you're using secure passwords.

quote:

---

and uses basically the same password across multiple platforms

---

Well frick.


It's good that she has concerns about password security, but her methods are all the exact wrong things to do if you want to secure your passwords. Convince her with this:

1. If a password site is hacked, the attacker does not automatically have your passwords. They will have an encrypted file which contains your passwords, and then they have to crack your master password to access your passwords. Choose a strong password for this, and if there is ever a breach you will have time to change your passwords.

2. Most password managers support multi-factor authentication. This means that not only does an attacker have to hack the password site and then crack your master password, they would ALSO need access to your physical phone in order to reveal your passwords. The Google Contacts app doesn't do this for you.

3. Having a personal code system to obfuscate your passwords is handy if you're writing them down somewhere, but if you use truly secure passwords (like those a password manager will generate for you) then a code system won't be helpful. Further, typing out secure passwords is a huge pain in the arse, so a password manager will help you out here.

4. Using the same password across multiple sites is the absolute worst thing you can do for security. If you worry about one site getting hacked and having your passwords stolen, repeating passwords multiplies the attack surface. Instead of just one site, now you have potentially dozens of sites to be hacked which would expose your password for all the rest.