this post was submitted on 14 Aug 2024
599 points (96.6% liked)

Privacy

32159 readers
418 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can't remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn't tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.

Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don't just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They're not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser's password storage is better than nothing. Don't reuse passwords, use long randomly generated ones.

It's free, it's convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I'm preaching to the choir, but if even one of you decides to use a password manager after this then it's an easy win.

Please, don't wait. If you aren't using a password manager right now, take a few minutes. You'll thank yourself later.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 7 points 3 months ago (4 children)

Is there manager than create password based on masterpassword and domain/username? Do not want to lose all password just because drive dies. Do NOT want to use cloud anywhere.

[–] [email protected] 8 points 3 months ago (2 children)

backups backups backups.

keep a copy on your computer, your phone, and every spare drive u have in the house. ask a friend to store the file at their place.

also, whats wrong with a cloud provider, if the file is encrypted ?

[–] [email protected] 4 points 3 months ago

Cloud can go down, cloud can delete my file, cloud can be hacked and someone try crack encryption (rsa vulnerable to quantum compute in future, maybe similar happen to aes).

[–] [email protected] -1 points 3 months ago (3 children)

Encryption won't last forever. The moment Quantum-computing will be a thing, all current encryption will be pointless. Depends on your level of paranoia and planning for the future 😁

[–] [email protected] 3 points 3 months ago* (last edited 3 months ago) (1 children)

This is not true at all. https://en.wikipedia.org/wiki/Post-quantum_cryptography good place to start if you're genuinely interested. Most password managers that are worth while will be using symmetric cryptography which just requires longer key lengths to survive in the quantum age. AES256 should be fine for the foreseeable future.

[–] [email protected] 1 points 3 months ago

Even IF there was a quantum-safe-cryptography, doesn't change the fact, that your most private stuff is in a cloud and you have absolutely no idea what the future might bring. And if i have anything in the past decades in the IT, then it's that there is always a past-past-something.

[–] [email protected] 3 points 3 months ago

only some asymmetric ecryption (rsa already known) vulnerable to quantum and still need much more qbit to work good.

symmetric encryption (aes) not known to be vulnerable, but maybe in future

[–] [email protected] 2 points 3 months ago (1 children)

I mean, you can change your passwords later on if you think a quantum computer broke them. In the case of quantum computers your network traffic is also gonna get cracked anyways, so they can steal your account information through that as well.

[–] [email protected] 2 points 3 months ago

One can't hack into where there is no path into :-) Also, whatever you COULD do in the future, a version of your passes where you didn't do it, already was in the cloud. It's not like you delete a thing there and it's totally gone forever.

[–] [email protected] 3 points 3 months ago (1 children)

Syncthing!

I use KeepassXC and sync my DB to my phone/laptop/desktop and backup to my server.

[–] [email protected] 2 points 3 months ago (1 children)

No db, only get password from master and domain/username.

[–] [email protected] 2 points 3 months ago (1 children)

I understand, but to solve the drive death issue, there are existing solutions which are easy and free.

[–] [email protected] 1 points 3 months ago

I know, but not answer to question.

[–] [email protected] 3 points 3 months ago

If you use a deterministic password manager, make sure you make your master password strong

[–] deluxeparrot 3 points 3 months ago (1 children)

There's a few. LessPass is one that has been going a few years.

[–] [email protected] 2 points 3 months ago (2 children)

LessPass and similar software has some problems. Things like you can't simply change your master password, you must then recompute and change every site. It's also not strictly stateless, since you need to know which password iteration you're on and the user name. Full fledged password managers also typically provide other secret management features, like API keys, SSH keys, credit/debit cards, and identity cards.

[–] deluxeparrot 4 points 3 months ago

That's true. But they do give you easy, portable, site specific passwords. No apps or database syncing required.

If you just want to log in to Lemmy on a work computer at lunch it seems a good option to me.

[–] [email protected] 2 points 3 months ago

Things like you can't simply change your master password, you must then recompute and change every site.

Obviously, it does not store password, only create them.

Full fledged password managers also typically provide other secret management features

Then they not password manager, they secret manager. With maybe random key generator.