Which is your preferred password manager software? 2nd Edition. New and improved

xpac5896 · Jan 24, 2023

Kelper;
The only problem here is that all websites require a password eight characters long and with upper case and lower-case letters with at least two numbers. If websites would adopt Steve Gibson's concept it would be a highly effective weapon against hacking passwords but, unfortunatly, until that day comes, we're stuck with what we got, and passwords will be hacked. I will bookmark his page as it has a great concept of how to really create a password.

TraderGary · Jan 24, 2023

I have 170 sites in my password manager. All site passwords are currently 20 or more characters long. My Master Password is currently a passphrase of 26 characters.

kelper · Jan 25, 2023

@xpac5896

I just wanted to make the point that the most important way of making a strong password, is to add length, rather than complexity.
I agree that we are bound by each websites silly rules.

Stigg · Jan 25, 2023

GoTo admits: Customer cloud backups stolen together with decryption key

We were going to write, “Once more unto the breach, dear friends, once more”… but it seems to go without saying these days.

nakedsecurity.sophos.com

LastPass owner GoTo says hackers stole customers' backups

LastPass' parent company says intruders stole the company's encryption key for securing its customers' backed up data.

techcrunch.com

trevo · Jan 28, 2023

Bitwarden password vaults targeted in Google ads phishing attack

Bitwarden and other password managers are being targeted in Google ads phishing campaigns to steal users' password vault credentials.

www.bleepingcomputer.com

Hazel123 · Jan 28, 2023

Not sure if it's been mentioned but Last Pass had a big data leak recently.

Yes, It’s Time to Ditch LastPass

The password manager’s most recent data breach is so concerning, users need to take immediate steps to protect themselves.

www.wired.com

Edit - read back and it has been mentioned - the article is useful though.

I use Firefox with a master password.

kgarrett67 · Jan 28, 2023

I just moved to BitWarden after the latest about LastPass, which I had used for years. I still used the built-in password manager within my browser, which seems to work really well, but I do like to store my passwords in the cloud for use if I'm on another computer.

Hazel123 · Jan 28, 2023

With the Firefox one, if you have a Firefox account, you can access everything on any computer

. Just by signing into the firefox account. Bookmarks, passwords, the lot. A master password means no-one else using the computer can access your passwords.

TraderGary · Jan 28, 2023

After spending a good bit of time with both Bitwarden and 1Password, I've decided to stay with LastPass. They all use the same standard Zero Knowledge Architecture and the same AES 256-bit encryption. Even though LastPass was breached, if your Master Password is strong, as it should have been, you are safe. That's the whole reason for having Zero Knowledge Architecture in a password manager. A breach can happen to anyone. Even though the bad guys have an old copy of the vault, they can do nothing with it without having Master Passwords and of course they have nothing if passwords have been changed since the breach.

kelper · Jan 28, 2023

The stories say encryption keys were stolen. I don't believe that, do you?

Edwin · Jan 28, 2023

Allow me to bring you up to speed on my situation...,
As stated previously, I voted 'My browser', (Chrome), which I'm confident is capable of managing efficiently, the meager 20, or so, credentials that I use on a daily basis, and mostly for casual browsing and research, etc., only.

Everyone's situation is unique and, everyone has different needs...,
me..., I'm a middle aged, non-professional who doesn't necessarily need to be connected while at work, or any other place, for that matter.
I live alone..., no one else has access to any of my devices at any time, whether I'm in my truck, at the grocery store, at church, sitting on the can or in the shower!!!
I don't do banking or government transactions online, (although, that might change soon due to the fact that it's becoming a real p-i-t-a!!!)

However...
... thanks to the insightfulness of @kelper , @TraderGary and others, I no longer use a simple notebook to store my approximate 150 credentials!
I now have all of them stored on an encrypted notepad, on a thumb drive, sealed in an indestructible metal capsule...,
and also on an encrypted NoteKeeper app for PC and Android.

That pretty much covers my needs..., your mileage may vary, but, thank you all for your insights, it's been an education!!!

TraderGary · Jan 28, 2023

kelper said:
The stories say encryption keys were stolen. I don't believe that, do you?

LastPass used a separate cloud storage for data backups. Before the backups, including users LastPass vaults, were stored, they were further encrypted with a proprietary binary encryption. The key to this encryption is what the threat actor got. After this decryption was done with the stolen key, the vault would still be fully protected by the AES 256-bit encryption that was done by the user's PC before it was ever uploaded to the LastPass servers.

The stories saying that encryption keys were stolen adds a whole lot of sensationalism and click-bait, doesn't it?

Tink009 · Jan 28, 2023

Bitwarden password vaults targeted in Google ads phishing attack

Bitwarden and other password managers are being targeted in Google ads phishing campaigns to steal users' password vault credentials.

www.bleepingcomputer.com

I saw this story yesterday and I checked on the Bitwarden Forum and the website mentioned in the story no longer exists. Someone is using Google Ads to tempt people into clicking on an ad instead of going to the legitimate website. 1Password was targeted as well.
Another reason for using ad blockers.

TraderGary · Jan 29, 2023

The forum members have certainly put a different slant on the poll after the LastPass breach. LastPass is currently down to only four votes, including mine. I wonder what effect the breach is going to have on the 33 million subscribers to LastPass? I mentioned it to a friend and the response was "what breach?".

Beaupeep · Feb 15, 2023

For those who may be using Bitwarden, here's an update. Their KDF function now has the option of using Argon2d algorithm w.e.f today 4 am GMT. Wait till your apps and browser extensions are updated to 2023.2.0 before you change the algo.

kelper · Feb 15, 2023

Why would I want to change?

jvickers · Feb 15, 2023

TraderGary said:
My Master Password is currently a passphrase of 26 characters.

That would be problematic for me since my working memory is only something like 7 characters!

Quandary · Feb 15, 2023

kelper said:
Why would I want to change?

To increase the difficulty in hacking attempts to decrypting your password. It costs you nothing but a little effort to make this change which enhances your security, so why not do it.

kelper · Feb 15, 2023

I asked Bing's new AI for an opinion.

Is Argon2ID better than "PBKDF" SHA-256?

Argon2ID is generally considered to be better than PBKDF SHA-256 for password hashing. PBKDF SHA-256 is a password-based key derivation function that uses SHA-256 as the underlying hash function. It is designed to be slow and resistant to brute-force attacks, but it has some drawbacks compared to Argon2ID1.

First, PBKDF SHA-256 is not memory-hard, meaning that it does not require a lot of memory to compute the hash. This makes it vulnerable to attacks using specialized hardware, such as ASICs or GPUs, that can perform many hashes in parallel with low memory cost2.

Second, PBKDF SHA-256 is not side-channel resistant, meaning that it can leak information about the password or the hash through physical measurements, such as power consumption, timing, or electromagnetic radiation. This can allow an attacker to recover the password or the hash without brute-forcing it2.

Argon2ID, on the other hand, is a memory-hard and side-channel resistant password hashing algorithm

OAT · Feb 15, 2023

Good little survey you have going @kelper.
Multiple choice answers for your next release?

I use the browsers backed up by Keepass.

Which is your preferred password manager software? 2nd Edition. New and improved

Which is your preferred password manager software?

Sticky Password

Bitwarden

LastPass

My browser

KeePass, KeePassXC and forks

EnPass

PasswordSafe

Dashlane

Roboform

1Password

Well-known member

My Computer

Stock Market Wizard

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Stock Market Wizard

My Computer

Well-known member

My Computers

♦ ♦

My Computers

Stock Market Wizard

My Computer

Well-known member

My Computers

Stock Market Wizard

My Computer

Well-known member

My Computers

Well-known member

My Computers

The lunatics have taken over the asylum

My Computers

Well-known member

My Computer

Well-known member

My Computers

Pragmatic Member

My Computers

Similar threads