It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can't remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn't tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don't just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They're not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser's password storage is better than nothing. Don't reuse passwords, use long randomly generated ones.
It's free, it's convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I'm preaching to the choir, but if even one of you decides to use a password manager after this then it's an easy win.
Please, don't wait. If you aren't using a password manager right now, take a few minutes. You'll thank yourself later.
I've been using Firefox's built in password store, plus 2fa for sensitive accounts when possible. Are there any known issues? Uploading all my passwords to someone else's server sounds silly.
Theoretically, it's possible to store a encrypted database on someone else's system in a way where they never have the ability to see its contents, as you encryption and decryption only ever happens in the client on your devices.
Whether this is actually done in a way that enforces that on various password managers is unknowable with proprietary code.
Personally I self-host vaultwarden. All the benefits of syncing my passwords across devices, but the server enabling that, runs on my hardware.
Firefox Sync is end-to-end encrypted. So Firefox's password manager with syncing does this.
To use that remote encrypted db, you need a stored client side secret, and a customer service department that deals with users who have lost that. See also "mud puddle test".
I'd not heard of the "mud puddle test" but I immediately thought that any provider that does that, is doing it wrong.
Unless there's an exploit of which I'm unaware, my self-hosted solutions pass the mud puddle test.
Companies have to know about the mud puddle test, but then they have to make an informed decision about whether they want to pass it. Hard disk and data recovery companies have been known to employ grief counsellors to help their customers cope with finding out that their disk drive is too trashed for the data to be restored. Choosing to pass the mud puddle test puts the password manager company in the same position. Some customers may, in fact, expect that recovering from the mud puddle is one of the services they are paying the company for. It's the same reason hosted databases like RDS are a thing. Either way though, the company should be transparent about how they handle this question.
I agree with all of that, I was just pointing out that "uploading all your passwords to someone else's server" can be done in a way that isn't silly. You're preaching to the choir.
Though even then, the best way is for that server to be yours, not someone else's. And it does come with advantages in terms of convenience.
The benefits of having my passwords on a server (even my own server) seem tiny compared to just occasionally having to type one into a second computer after generating it on the first. If I had used a dozen computers instead of two, maybe it would be something to think about.
I don't understand.
You only use each passwords once? You never log in to things on a new device without the one on which you created the account on hand? You only ever need authentication on two devices?
I own half a dozen devices on which I might want to log into places, and on several occasions it has been extremely useful to be able to access my password database from a completely new device from anywhere in the world, with nothing but the memorized master credentials.
I don't think you can argue that the advantages don't exist, even if they aren't useful to you personally.
For web browsing I use either my laptop or my phone, two devices. I could imagine having more but for now there are just those two.
KeePassXC is entirely local.
LastPass (ironically) explains this best: https://blog.lastpass.com/posts/2022/06/why-you-shouldnt-store-passwords-in-a-browser
Thanks but the LastPass article is partly inapplicable and partly marketing. The one good point it makes for non-corporate users is about leaving your browser open where attackers can access it, say at the office. For a while I tried using a FIDO2 token but they weren't well enough supported at the time. Maybe that is easier now.
I guess the reasons I would make would be not all accounts are web-based, and using a browser for anything other than browsing is a bad idea. Browsers aren't exactly focused on keeping passwords safe, so why not use a tool designed for it? Don't keep all your eggs in one basket
P.S. Yes, FIDO2 is much more supported
I guess I use a few APIs with auth tokens that are like passwords but I don't see how a password manager would help. Yeah the tech for this stuff could be better, but vendors keep messing it up.
What about your Lemmy account?
On my laptop I use the Firefox password store. On my phone I mostly use Voyager which presumably stores the password in a protected app file. It could probably be extracted by rooting the phone but that has gotten harder to do, and anyway it's also in Firefox on the same phone. Voyager is basically an API client. I can see some interesting ways to improve this but haven't cared enough.