this post was submitted on 03 Aug 2022

51 points (98.1% liked)

Privacy

32003 readers

821 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

What is your favorite password manager? (lemmy.ml)

submitted 2 years ago by imgprojts@lemmy.ml to c/privacy@lemmy.ml

79 comments fedilink hide all child comments

I started digging into opensource password managers and found that they all suck major ball sack. I ended up picking nothing. My two runner-ups were bitwarden. It works on Linux, Android, whatever apple's shit runs on, and even runs on PC's with the OS that you usually delete first thing. But the major drawback is that I can't trust it. It's got a "premium" version, and that has always meant a slow steady spiral into "you must pay now that we have you by the balls" situation. Another drawback is that it's centralized, kill the company and so go your passwords I suppose.

The other runner up is called liso. This one comes with two major drawbacks. One is that is browser only so far. The other one is that it doesn't work on Linux yet. Such a shit shit option. Everything else out there wants you to pay for encryption.

I did end up learning about pass on Linux. It creates encrypted passwords and there's some compatibility with guis and maybe available on Android??? Big question mark. I've tried nothing yet. My password list seems to grow daily.

So what's your favorite one?

you are viewing a single comment's thread
view the rest of the comments

[–] SrEstegosaurio@lemmy.ml 3 points 2 years ago (1 children)

I would not recommend PGP/GPG for anything. There are a ton of reasons to ditch it and move to something better, for every single usecase.

[–] Amicchan@lemmy.ml 3 points 2 years ago (1 children)

Why?

[–] SrEstegosaurio@lemmy.ml 2 points 2 years ago* (last edited 2 years ago) (2 children)

There was a really good article about why pgp/gpg is a pice of radioactive waste that should be avoided at all costs. Both the standard and the de facto implementation.

Sadly I don't have the link with me rn. Let me search it.

Edit: here's the link https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

Also, use age & signify over pgp.

[–] KLISHDFSDF@lemmy.ml 2 points 2 years ago

Great read! Thanks for sharing.

[–] Amicchan@lemmy.ml 2 points 2 years ago (1 children)

It's not a good look for the blog author when they suggested using Signal and WhatsApp, proprietary but open-source apps.

Is age and signify battle tested?

[–] SrEstegosaurio@lemmy.ml 2 points 2 years ago (2 children)

Signal is not propietary. And in terms of security the Signal protocol is the best with diferenre you can get out there.

[–] Amicchan@lemmy.ml 2 points 2 years ago* (last edited 2 years ago) (1 children)

And in terms of security the Signal protocol is the best with diferenre you can get out there.

https://dessalines.github.io/essays/why_not_signal.html#why-not-signal

SIgnal is just as bad as insecure western social medias.

~~Why do so many crypto bros favor Signal?~~

I'll ask this again: Is age and signify battle tested?

[–] SrEstegosaurio@lemmy.ml 2 points 2 years ago (1 children)

Signal is far from being perfect. And I would love a decentralised (p2p/federated) chat protocol implementing the Signal protocol. At the time being their protocol is best, we may question their main server and some of their practices, but at the time being I couldn't find anything better.

SIgnal is just as bad as insecure western social medias.

Hmmm… I don't think so.

Why do so many crypto bros favor Signal?

I'm not a cryptobro. :c

I’ll ask this again: Is age and signify battle tested?

Their as not as old and extended as PGP but their are based on solid cryptography.

[–] Amicchan@lemmy.ml 1 points 2 years ago* (last edited 2 years ago) (1 children)

Did you read all of this page? It shows the alternatives. (Matrix, XMPP)

Their as not as old and extended as PGP but their are based on solid cryptography.

Explain.

[–] SrEstegosaurio@lemmy.ml 3 points 2 years ago* (last edited 2 years ago) (2 children)

I would not consider Matrix an alternatdve to Signal. The Matrix protocol is messy and I had a lot of " matrix moments™" (even with that I still use it and prefer it over Discord, or other glowy apps.). XMPP with omemo is great, no need for a phone number and decentralised. I like it.
(I think that I heard somewhere about the signal protocol on XMPP or something like that. Which, in my opinion could be the best of both worlds.)

Explain.

What I mean is that obviusly is not as battle tested as PGP/GPG since is not that old and it's not as spread as it, now. But PGP is extremely complicated, overextended, with terrible defaults and backwards compatability with some stuff from the stone age. The de facto implementation is also quite bad.

As I still have to use PGP for some things (sadly) I use a better implementation: sequoia-pgp I reccomend it. https://sequoia-pgp.org

[–] Amicchan@lemmy.ml 2 points 2 years ago

I would not consider Matrix an alternatdve to Signal. The Matrix protocol is messy and I had a lot of " matrix moments™"

How is the matrix protocol messy? It had extraneous metadata, but it got removed in a version.

Also, what is a "matrix moment"?

XMPP with omemo is great, no need for a phone number and decentralised. I like it.

Why not just use that then?

What I mean is that obviusly is not as battle tested as PGP/GPG since is not that old and it's not as spread as it, now.

That's a problem when choosing security tools. How do you know the reliability of the tool if it hasn't been battle tested enough?

But PGP is extremely complicated, overextended, with terrible defaults and backwards compatability with some stuff from the stone age.

I would need to scan the GPG source code to try to understand your point, but I don't have the time or will to do so.

What terrible defaults though? GPG's defaults seem fine to me. I might be missing stuff tho.

[–] SrEstegosaurio@lemmy.ml 1 points 2 years ago

Btw, sorry for my terrible wording and lack of lexic. I'm still learning. :D

[–] thervingi@lemmy.ml 2 points 2 years ago (1 children)

Signal is validated over sms and uses a ton of Google APIs. I'll pass.

[–] SrEstegosaurio@lemmy.ml 1 points 2 years ago

Okey, I agree on the fact that their server and client may be far from perfect. But the only problem with their protocol is that it's not decentralised.