this post was submitted on 05 Jul 2023
44 points (95.8% liked)

Asklemmy

43823 readers
905 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

  1. Open-ended question
  2. Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
  3. Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
  4. Not ad nauseam inducing: please make sure it is a question that would be new to most members
  5. An actual topic of discussion

Looking for support?

Looking for a community?

~Icon~ ~by~ ~@Double_[email protected]~

founded 5 years ago
MODERATORS
 

I was gonna ask about the biometrics part in a separate question, but its both about security, so might as well combine it in one post.

Okay so I don't use password managers. I just try to make easy to remember passwords 3-4 random words + 3-4 random numbers. ~~Online accounts can't be brute forced anyways.~~ Edit: I mean most websites have log in limits don't they? Maybe I've been mistaken?

For offline accounts, I just increase the words and numbers. For mobile I don't use biometrics, although I've been testing whether or not I want a pin + no biometrics or alphanumeric password + biometrics. I just can't decide.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 4 points 1 year ago (1 children)

That depends on the password manager.

There are password managers that work on your computer and the data never leaves your hardware. KeepassXC for example. The database is just a file on your computer - you are in charge of backing it up, synchronizing it to your other devices (i.e. phone) etc. The database file is fully encrypted so you could share it with a cloud provider like google drive or dropbox, or you could use syncthing which synchronizes files between your devices without cloud storage. If you use cloud storage there's a small risk that the encrypted file gets into the wrong hands (but it is encrypted so it's most likely worthless to any would be hacker).

Some other password managers offer a web service where you can log into a website to see your passwords, and they have mobile apps and browser extensions. These do store your passwords in their cloud - the risk that those get breached is considerably higher. But even there it depends on the implementation details. Bitwarden for example kind of does something similar to keepass, where your "vault" is encrypted locally and then stored on their servers. Even if they get breached, the data would be useless. Lastpass had a breach recently and it turned out that they didn't encrypt everything - so someone with access to the data could determine some details such as which sites a user had accounts on. And apparently some vaults used a weaker encryption so those might be decrypted eventually.

And a lot of password managers are closed source so there's no telling what they may do, just "trust me bro".

If I had to give a recommendation it would be bitwarden - it's open source, it's free although there is a paid plan if you need it and want to support them. It's really easy to use. If you have extreme paranoia (no judgement) then keepassxc - it's also open source and free, it's just a little more effort to set it all up so it doesn't get my first choice.

[–] [email protected] 1 points 1 year ago

Wow—thank you for such a detailed response! This definitely gives me a better idea of the differences and how they work. I’ll give Bitwarden a try. I see it recommended several times in other responses and your detailed description gives me confidence you know what you’re talking about. Thank you again!