this post was submitted on 27 Oct 2023
1304 points (97.9% liked)

Memes

45751 readers
1396 users here now

Rules:

  1. Be civil and nice.
  2. Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.

founded 5 years ago
MODERATORS
 
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 21 points 1 year ago (3 children)

Just use a password manager, then you get the benefits of having a single password to remember without the security-related downsides.

[–] [email protected] 19 points 1 year ago (3 children)

I never got over the fact that I somehow need to trust to an absurdly high degree a proprietary software to store ALL my passwords. Is this really a good idea?

[–] Aicse 24 points 1 year ago (5 children)

You can use KeePass, but you'll have to figure out a way to have your password vault available on other devices (can do it by using any cloud shares, i.e. GDrive). This way you'll be in charge of almost every aspect of your passwords. But you'll have to take care of backups and keep everything in sync.

[–] Viking_Hippie 13 points 1 year ago (3 children)

KeePass

I'm sorry but no. I'm physically incapable of not moving the capital letter one space and I'm not entrusting my passwords to what I've irrationally decided IS named KeepAss. I just can't.

[–] [email protected] 13 points 1 year ago

I like Vaultwarden. Open source rust server compatible with bitwarden.

[–] [email protected] 10 points 1 year ago

And then there's KeePassXC.

Get it? Keep-Ass-Sexy :)

https://en.wikipedia.org/wiki/KeePassXC

[–] [email protected] 7 points 1 year ago (1 children)

Just imagine keeping your passwords in your ass and you should be fine.

[–] Viking_Hippie 2 points 1 year ago

I've had that dream before, didn't help..

[–] [email protected] 9 points 1 year ago (1 children)

Or simply can use, Bitwarden or Protonpass

[–] [email protected] 2 points 1 year ago

I read a bit into bitwarden and it seems quite good, also with browser extension etc. Maybe I will think about my stance on password managers and give it a try

[–] abominable_panda 3 points 1 year ago

Syncthing works very well for cross platform syncing

[–] [email protected] 3 points 1 year ago

It seems bitwarden is a bit more user friendly and also quite good in terms of security and privacy related issues (FOSS as well!) . Thanks for the help!

[–] [email protected] 2 points 1 year ago

I have this issue with bit warden

[–] [email protected] 11 points 1 year ago (2 children)

There are libre off-line password managers. Variants of Keepass for example.

Indeed it's a bad idea to store passwords in a propietary system. Specially a cloud based one being hacked time to time, like 1password.

[–] TrickDacy -2 points 1 year ago (2 children)

I'm unaware of 1password ever getting hacked.

Even if they did, there's some really smart technology at play here. I think your paranoia here is unjustified. I felt the same way until I read about their technology. At that point I felt comfortable using their service.

[–] [email protected] 3 points 1 year ago (1 children)

I mean, just three days ago we had this incident, which is probably what they are referring to: https://blog.1password.com/okta-incident/

Anyway, iirc, 1password is architected in a way where a breach won't actually disclose the passwords of their users, but I'm too tired to do the requisite double-checking to verify it

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago) (1 children)

I’m unaware of 1password ever getting hacked.

https://cybersecuritynews.com/1password-hacked/?amp

I think your paranoia here is unjustified

You are right in a way. I always assume company sysadmins have access to company data, even if they say the opposite, and I always assume there are undisclosed data leaks. Which may seem a little paranoid.

It's like closing your car's door when leaving it alone: Is it paranoid to assume that always there are someone willing to steal stuff?

[–] TrickDacy 0 points 1 year ago (1 children)
[–] [email protected] 0 points 1 year ago (1 children)

1password employees don’t have access to the data let alone anyone else.

That's a common good practice.

It's still good idea to assume the opposite.

If you can see plain text passwords, some malicious actor at their side can too. No matter if it's encrypted at rest.

[–] TrickDacy 0 points 1 year ago

No, I don't think it's healthy to move through life in such a paranoid state. If I thought that, I wouldn't use a password manager and that would leave several problems unsolved, chiefly I would only be able to remember a couple passwords, opening my identity up for hacking several orders of magnitude likelier to actually happen than 1password's entire technology stack failing at its one job.

[–] qqq -2 points 1 year ago* (last edited 1 year ago)

A lot of weird hate for 1Password on Lemmy the past couple days. I highly recommend reading their white paper, I think most of the hate comes from ignorance of what they are actually doing.

https://1passwordstatic.com/files/security/1password-white-paper.pdf

[–] ClamDrinker 2 points 1 year ago* (last edited 1 year ago) (1 children)

It's the choice between trusting one company (or if you self host, trusting yourself) to have their security all in order and properly encrypt the password vault. Using one password for every site you use means that you have to trust each of those sites equally, because if one leaks your password because they have atrocious password policies (eg. storing it in plain text), it's leaked everywhere and you need to remember every place you used it before.

Good password managers allow audits, and do at times still get hacked naturally (which isn't 100% preventable). Yet neither of these should result in passwords being leaked. Why? Because they properly secure your master password so it can't be reverse engineered to plain text, and without the master password your encrypted password vault is just a bunch of random bytes. And even in the extreme situation it did, you know to switch to a better password manager, and you have a nice big list of all the places where you need to change your password rather than trying to remember them all.

Human memory is fallible and we want the least amount of effort, because of that we usually make bad passwords. Your average site does not have their password security up to date (There's almost a 0% chance not one of your passwords can be found here). If you data is encrypted accordingly, it doesn't matter if it gets leaked in any way or stolen by some rogue employee, so long as they do not have your master password. So yes, I'd say that's a good idea.

[–] [email protected] 2 points 1 year ago

Nicely said, thanks for the long read!

[–] Mr_Dr_Oink 10 points 1 year ago (6 children)

So all my passwords are locked behind a single password? Isnt this essentially the same as using the same password for every site. In that they only need to cracl o e password to have access to everything?

[–] [email protected] 7 points 1 year ago

In theory, yes but if you use a good password manager and have a strong master password the encryption should be practically impossible to break. The fact that you only have to remember one password means that this password can and should be a very strong one. 20+ characters with upper and lowercase letters, numbers and symbols should take centuries to crack.

[–] baatliwala 6 points 1 year ago* (last edited 1 year ago) (1 children)

You should be safe as long as your master password isn't small, less than 15 characters. The longer the password, the better. Personally what I do is use a pass phrase to make it easily memorable, and then use it as a base to inflate security somewhat artificially.

Wrap the pass phrase around in brackets or symbols; mix lower/upper case; replace (or add to) a word in your pass phrase with one from a random other language, so instead of hello you type bonjour. Bonus points if you are able to replace even a few letters in your pass phrase with fancy diacritics, or fuck it add an emoji or two.

Then again there are a LOT of other factors which go into security. Theoretically the lyrics of song are decent as a pass phrase but there's not much point if everyone knows what your favourite song is, or if you are learning Spanish then you'll replace the English words with Spanish.

Unless you're in a position where you're targeted by nations or are working extremely high profile jobs like CEO or digital security you should be safe really with all these but as I said there's a lot to keep in mind.

[–] Mr_Dr_Oink 1 points 1 year ago (1 children)

How does this all compare to using 2fa everywhere?

[–] baatliwala 1 points 1 year ago

2FA is in the name, 2 factor authentication. A "factor" can be considered as proof that you are who you are. The more the factors provided, the more concrete proof the system has that the user is legitimate.

What a factor is is a more complicated. It can be broadly put in 3 categories (there's more but we'll ignore for now) :

  • something you know, like a PIN/password
  • something you are, like biometrics/eye scanning
  • something you have, like an ATM card or phone

The 2FA you are thinking of is probably the 1st (a password you know) + a PIN sent to or generated by something you have (a phone). If the 2nd pin was some you had created by memory like a password rather than a remote system generated one then it would be considered same as the first factor, it wouldn't be multi factor.

So yeah it's important that you keep both factors as secure as possible. A good password + a phone to generate TOTPs. I mean theoretically you can keep a password of ABC and keep 2FA on so hackers wouldn't be able to get into your system but let's follow best practices yeah? Use a password generator to make complex passwords for a login and enable 2FA.

[–] [email protected] 5 points 1 year ago

Just don't use your master password anywhere else than your password manager.

If your password manager only works offline, then it is impossible to leak on the internet.

[–] [email protected] 2 points 1 year ago

Depends if you trust your password manager site more than either site you put the same pw into

[–] qqq 1 points 1 year ago

This is not necessarily true.

For example, consider the case of a 1Password vault falling into the hands of an attacker. They do not have the option to just crack your password, as the password is mixed with a randomly generated value to ultimately derive the key. They would need to simultaneously brute force your password and that random value. This should almost be impossible. However, given access to a client that already has knowledge of the secret value, it would fall back to brute forcing the password.

[–] [email protected] 2 points 1 year ago (1 children)

I have been wondering as of lately, I'm an old Bitwarden user and I use their generated passwords which are just a random mess for my eye, anyway when a leak occurs I usually tend to type my known passwords to match it with the leak lists, but now all this being auto generated and I be totally clueless of which is which, how would I ever notice if one of those more secure passwords are leaked?

Does Bitwarden let you know of leaked passwords as Chrome and I think Firefox does? Because I don't recall having this info in hand.

[–] smrtprts 1 points 1 year ago

You can go into your vault and choose a password to see if it's been exposed on the web. It's a little check mark by the password.