this post was submitted on 14 Aug 2024
350 points (100.0% liked)

Privacy

789 readers
55 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can't remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn't tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.

Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don't just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They're not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser's password storage is better than nothing. Don't reuse passwords, use long randomly generated ones.

It's free, it's convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I'm preaching to the choir, but if even one of you decides to use a password manager after this then it's an easy win.

Please, don't wait. If you aren't using a password manager right now, take a few minutes. You'll thank yourself later.

(page 2) 50 comments
sorted by: hot top controversial new old
[–] Rubanski@lemm.ee 4 points 3 months ago (3 children)

How do I convince my girlfriend to stop using her safari password manager and migrate it to bitwarden? Is the password manager in Safari so unsafe that it's worth the additional effort she might ask.

[–] unrushed233@lemmings.world 2 points 3 months ago

It's not that bad, but tell her that she can set Bitwarden as the default option for auto-fill in the settings and everything will get automatically filled in, just like with the normal Safari password manager

load more comments (2 replies)
[–] clark@midwest.social 3 points 3 months ago (1 children)
load more comments (1 replies)
[–] korthrun@lemmy.sdf.org 3 points 3 months ago* (last edited 3 months ago)

So many folks talking about which software they use, and how they sync it between devices etc.

You all know there are hardware password keepers right? They present to your devices as a usb and/or bluetooth keyboard and just type out the user/password that you select. They have browser plugins to ease the experience. Now your password is not even stored on the device you're using to perform your login and it will work on any modern device even without internet access.

Oh and no subscription fee to cover the costs of cloud infrastructure.

[–] Kit@lemmy.blahaj.zone 2 points 3 months ago (4 children)

I don't recommend Bitwarden. I used them in a corporate environment and they lost all of our company's credentials. It was a huge hit that cost tens of thousands worth of man-hours to overcome. Their response was to shrug and say sorry. We were paying a premium for their services, too, and have moved onto LastPass.

[–] JustMarkov@lemmy.ml 3 points 3 months ago (1 children)

moved onto LastPass.

I couldn't imagine a worse decision.

load more comments (1 replies)
load more comments (3 replies)
[–] zeh_ahoi@lemmy.ml 2 points 3 months ago (2 children)

i dont understand this post. like every browser has a password manager, why install some 3rd party you can even trust less?! am i missing something? doesnt safari have a password manager? is keepasscx really safe (CVE-2023-32784)? or bitwarden (https://blog.redteam-pentesting.de/2024/bitwarden-heist/)?

[–] Cube6392 3 points 3 months ago (3 children)

In-built password managers for browsers are straightforward to crack. Like… Terrifyingly easy. It's much better to use something like Bitwarden, Vaultwarden if you don't trust Bitwarden, 1Password if you really want the reassurance of paying someone for trust, or KeePass if you don't trust anyone at all (I, personally, fit into this category).

load more comments (3 replies)
load more comments (1 replies)
[–] gwen@lemmy.dbzer0.com 2 points 3 months ago (1 children)

just. write it down? in a notebook? keepassxc is rly good if you dont want to do that though

[–] ililiililiililiilili@lemm.ee 3 points 3 months ago* (last edited 3 months ago)

But what if you lose the notebook? Or just don't have it on you, when you need it? God help ya if someone malicious gets it. Keep it digital, always available, backed up, and secure.

[–] Zicoxy3@lemmy.ml 2 points 3 months ago (3 children)

I have been using password gestoires for a long time. First LastPass, until I switched to GNU/linux and discovered Keepass and then KeepassXC.... For me they are indispensable. That's the one I used until about 1 year ago when I started having problems with the Firefox addon. It did not recognize the pages. I tried ProtonPass and I like it, but I don't like having them online, no matter how secure the site is. I've tried going back to KeepassXC, locally, but the file I export from ProtonPass won't load in KeepassXC. I feel stuck.

Translated with DeepL.com (free version)

load more comments (3 replies)
[–] Mio@feddit.nu 2 points 3 months ago* (last edited 3 months ago)

I have the need to have different accounts to everything. Hate to perform the sign up process over and over again. They really need to standardize this.

Passkeys is one step forward but far from enough.

I hate the idea of having to login again and again with just a minute interval that I see BankID requires as it is for different things. Like I constantly have to prove it is still me here. BankID is the app in my country that gives you access to your Bank account, government stuff and so on. It connects to your personal number and ID you in real life.

So the issues you describe is just the result of how bad designed the web is today. It is simple for every company but hard for the user.

[–] zephorah@lemm.ee 2 points 3 months ago

I’m not in IT but I followed the Michael Bazzell podcast until he disappeared. Guy was a bit paranoid but there was great info there. My understanding was browser saving passwords isn’t secure, that those passwords are open to scraping from bad players. Ofc I can’t reference this because the entire body of over 300 podcasts disappeared with him.

Agree on Bitwarden and such.

[–] mechap@lemmy.ml 2 points 3 months ago (3 children)

Whatever solution you think you can come up with is most likely not secure.

Having my passwords written down on a piece of paper is not safe ?

load more comments (3 replies)
[–] monobot@lemmy.ml 2 points 3 months ago (3 children)

It is truly upsetting to see how complicated for use password managers are.

I grow up around computers and I can barely mange them. Other people just don't understand how to use them, it is complicated and inconvenient. Even after I set them up and show them multiple times, friends don't manage.

In browser password managers cover 90%, but I guess web sites and apps need to start testing UX for password managers. Some of them introduce stupid flows that brake all of them.

Android is complete shit show.

It is not users, but applications and UX that doesn't care about security.

[–] MerchantsOfMisery@lemmy.ml 3 points 3 months ago (1 children)

Bitwarden on Android, particularly if you have biometric unlock enabled, is extremely simple to setup and use.

[–] frezik@midwest.social 2 points 3 months ago

Sorta. I find it doesn't always pop up Bitwarden to select an autofill. Then I unlock it manually, and sometimes it then gives me the button for autofill. Sometimes not and I have to manually copy and paste.

And sometimes there's a broken ass app that blocks you pasting passwords. People need to be fired for this.

Same thing happened to me on Last Pass, so I'm pretty sure it's an Android issue.

[–] ray@lemmy.ml 2 points 3 months ago

What's wrong with android? I have bitwarden setup any basically any time I tap a password field it offers me to fill in from my vault.

load more comments (1 replies)
load more comments
view more: ‹ prev next ›