Solved Which is your preferred password manager

LeLibran said:

Be careful, the Webpage the quote is from is NOT THE OFFICIAL WEBSITE for KeePass (see the disclaimer at the foot of the page).

The official site is here KeyPass Official Page and make no similar statement, but does give very detailed guidance on a variety of synchronisation possibilities. Please also note there are two official versions of KeyPass, which use different database formats, plus a number of forks, one of which KeyPassXC I use because it is cross-platform (Windows, Mac & Linux).

Click to expand...

The links you posted are correct, but you have misspelled KEEPASS, which might confuse somebody...

Are the forks as secure as the original? How would we know?

Wynona said:

Since there wasn't an "other" or "none of the above" option, I couldn't vote.

However, I use None of the Above, and my Other option is to use an Address Book with my own coding:

Say I want to join Best Buy. I write Best Buy on the Name line. The link goes on the Address line (if necessary).

The third line contains my username/email address: Say my email addy is XanaXZender; I code it as xyz/out with my true password on the next line. I have two email addresses, and two usernames so it's kinda required that I have both email addresses represented.

Because I never write my complete email address in that book, and I don't write any of the info in my computer, nobody's gonna get in. I have Firefox set up to delete all history when I close it with just about everything else.

I may have made it seem complicated, but it's not really . . .

Click to expand...

Anyone who knows you will likely know your emails. Hacking could come from a family member.

trevo said:

The links you posted are correct, but you have misspelled KEEPASS, which might confuse somebody...

Click to expand...

Thanks trevo I've corrected my original message (caught out by spellcheck again)

Could you add “other” to the poll? I use Firefox with a master password and Microsoft Authenticator

kelper said:

What does that prove?

Click to expand...

Same as your previous quotation lol

kelper said:

My passwords are salted and then encrypted with open-souce software. They are impossible to decrypt.

Each to his own.
Anyway, it's my poll!

Click to expand...

Fallacy. Nothing digital is impossible to decrypt - not even KeePass databases, not even government secured connections.

Nothing is impossible to decrypt.

kelper said:

Does KeePass encrypt user names and website URL's?

Click to expand...

barreleye said:

I've never actually thought about that in the 19 years I've been using KeePass. There's one database file, and it's encrypted. I can't imagine the mentality that would only encrypt part of it, or how it wouldn't have been condemned if implemented that way. lol

Click to expand...

100% - there are not separate parts of the database. It's all one database, that is decrypted as needed.

kelper said:

Yeesh, if you have only used one password manager how can you express a preference?

Click to expand...

One can have an opinion in that the one that they have used has served them well, and so that is why they've stuck with it.

Invalidating opinions based upon usage? It's your poll, sure, but read your poll again. I don't see anywhere where you ask for validation by having used more than one product, or having used a product for X amount of time, or having to be a security personnel / researcher to be able to weigh in. Come one, man.

trevo said:

"KeePass database files are encrypted. KeePass encrypts the whole database, i.e. not only your passwords, but also your user names, URLs, notes, etc."

Security - KeePass

keepass.info

Click to expand...

This, 100%

kelper said:

Are the forks as secure as the original? How would we know?

Click to expand...

Because the forks are all open sourced and hosted where anyone can inspect the code and independently verify any and all functionality. Some forks may have been abandoned, as happens with software all around, but between KeePass (whose dev Dominik Reichl works with security researchers around the world to develop and maintain the KP standards) and KeePassXC (a fork that has turned into an app all of its own, which still adheres to said KP standards), along with some OS specific forks (KPDX, KP2Android, etc.), they are all open source.

Other than Bitwarden, how may of these commercial offerings can say they are openly tested and provide open source code to help prevent issues, mitigating them before they go live? How many will give you a look at their cloud hosting capabilities, and let you fully control everything, from database to storage to sharing?

Hazel123 said:

Could you add “other” to the poll? I use Firefox with a master password and Microsoft Authenticator

Click to expand...

No, as I said very recently, You can only have 10 options in a poll and it can't be edited by me now.

kelper said:

Are the forks as secure as the original? How would we know?

Click to expand...

Well they are all open source so all their code can be directly analysed and compared, but for most users the decision will, as usual, be largely down to research into trusted review sites and user feedback, including that on relevant User Forums/GitHub sites. The one I now use, KeePassXC, provides all comparative information and I know originated from a 'community user group' desire to build on the original KeePass distribution by providing a more modern interface with some added features, including macOS compatibility, whilst retaining database compatibility with the proven reliable KeePass database structure and encryption methods; and I am happy that my data is at least as secure as it would be with any specialist online service, i.e. to get at it someone would have to get hold of one of my computers; hack into the 'correct' user account; gain access to the password manager; and then hack in to the encrypted database. - Well beyond the capabilities of the average sneak thief who is only after a quick return on their effort. 'Professional' Hackers are more interested in targeting major players and/or are con-artists looking for soft/gullible targets.

As with all security (and other) apps it's up to the user to make their own decision about what they are most comfortable with; and my preference is to use an application that I can directly manage and that's not a remote online service. If I need online synchronisation of the application's encrypted database, which in my case is 100kb, then that can be easily achieved via any personal cloud-based account, or even a home 'my cloud' server, without having to contribute to any paid specialist third-party site, which clearly presents a more obvious direct target for hackers if all they are known for is storing user details and password data.

johnlgalt said:

I don't see anywhere where you ask for validation by having used more than one product,

Click to expand...

I asked for preferred PM!

For your PW Manager here is a Strong PW Generator.
I use this one called Strong Password Generator for 1 important website, my other (investments) I have a (portable) token that updates every 20 seconds they gave me.

SmokeMe said:

I use this one called Strong Password Generator for 1 important website, my other (investments) I have a (portable) token that updates every 20 seconds they gave me.

StrongPasswordGenerator

Generate a random password! You can choose between 4 and 32 characters, and include numbers, symbols, uppercase, and lowercase letters.

privacycanada.net

Click to expand...

But that only generates passwords...

kelper said:

It is only possible to have ten questions in a poll. I wished to know which program made the best password manager, not really interested in paper systems

Click to expand...

Oh, so you're not interested in the complete story.

Sorry I busted in on your thread. I'll now unwatch it.

I asked Bitwarden if all our data in the vault is encrypted and they said, yes.

"Does Bitwarden encrypt user names and site URL's in the vault?"

"Yes, both usernames and URLs as are all items in the vault.
Among the many reasons Bitwarden is secure:

• It's open-source.
• Every bit of user data is encrypted.
• We are regularly audited, you can take a look details of how we stay on top of this here (Compliance | Bitwarden).
• We take extensive efforts to protect user data and limit what we need to collect.

For an in-depth look at the security measures that we take, please have a look at one of our white papers here (Bitwarden Security Whitepaper | Bitwarden Help Center)."

kelper said:

I asked for preferred PM!

Click to expand...

I've only ever driven cars, not motorcycles or three wheelers. So you're saying I cannot prefer to drive cars because I've never driven 2 and 3 wheelers?

Seriously, come on man. A person who started using something and continues to use it even having not used another product is still making a preferential choice to use that product they've always used. It is still a preference.

SmokeMe said:

For your PW Manager here is a Strong PW Generator.
I use this one called Strong Password Generator for 1 important website, my other (investments) I have a (portable) token that updates every 20 seconds they gave me.

Click to expand...

Both KeePass (and it's spinoffs) and BitWarden have this built in as well.

kelper said:

I asked Bitwarden if all our data in the vault is encrypted and they said, yes.

"Does Bitwarden encrypt user names and site URL's in the vault?"

"Yes, both usernames and URLs as are all items in the vault.
Among the many reasons Bitwarden is secure:

• It's open-source.
• Every bit of user data is encrypted.
• We are regularly audited, you can take a look details of how we stay on top of this here (Compliance | Bitwarden).
• We take extensive efforts to protect user data and limit what we need to collect.

For an in-depth look at the security measures that we take, please have a look at one of our white papers here (Bitwarden Security Whitepaper | Bitwarden Help Center)."

Click to expand...

If I did not use KeePass, this would be the only one I would even consider using as a commercial product.

However, let's be fair:

In 2020, their audits were conducted by the same group of people. That was a little bit suspicious, as their 2018 audit was by a much more reputable group and was a really good audit.


All in all, though, it looks like a fairly decent product to me, and the pricing for families is very reasonable, if you're inclined to think that you have to pay for something for it to be good.

johnlgalt said:

I've only ever driven cars, not motorcycles or three wheelers. So you're saying I cannot prefer to drive cars because I've never driven 2 and 3 wheelers?

Click to expand...

If I ask someone which is their preferred airline, I don't want answers from people saying I have only used SouthWest or I have never flown.
My poll was seeking informed opinions on password managers ie software, not some hick paper system. TIC

Sometimes I wonder why people post here when they face such hostility.

If you found my posts hostile, my apologies. But I do think that the poll was not clearly made to indicate you wanted users only to answer if they had used more than one of the systems you listed. So, it's a combination of clarity, both on the writer's part and the reader's part.

Maybe in the future be a little more detailed so we know what you are looking for and you don't get 4 or 5 (or 50) people posting about alternatives to your poll that you're not interested in hearing about. I showed how I define preferred in my last post. It's obviously not your definition, as I can see now - but I had no way of knowing that from reading the initial poll. So, yes, I misinterpreted the poll.

I must disagree respectfully. I did not just ask which PM you used, I asked which you preferred.
Anyway, let's start over. You did not need to apologise but it was very gracious of you to do so and I appreciate that.

Maybe I am pedantic about the English language but I am English!

But you did so with your own definition of the word preferred in mind - which is not my own definition. Preferences are not just choices between alternatives, a choice is still made even if you've never used an alternative. Again, you did not ask for people to pick if they had used more than one of the answers, and a person using only one for their entire time are still using it because it is their preference to keep using that and not try any other PWM out there. The same way I prefer to drive a 4 wheeled car and not a 2 wheeled motorcycle or 3 wheeled vehicle, even having never driven either of those two alternatives. It is my preference to only drive 4 wheeled vehicles, and if that exact poll was presented, only instead of PWMs you had listed all types of vehicles, with cars / 4 wheeled vehicles being a choice, that would have been my choice - and you cannot tell me that my choice is invalid. It was, is and will most likely always be my preferred method of transportation.

I've neither been rude nor have I said anything that is incorrect - I suspect you conduct a poll with as large a sampling as you like, and you';ll find the vast majority of people will agree with me - preference is personal choice, and can be made even if you've never used any alternatives.

And that is all I am going to say on this subject.

This Thread has been very interesting to me, as a discussion about Password management; as can be seen, not everyone uses a software solution for their passwords.

The Poll itself is of little value, but I've found the discussions informative and have sensed no "hostility".

I might start a poll to see if we should be allowed more than ten responses in a poll!
I wonder how many people's passwords are misused by teenage children and angry spouses / partners?
So many in my extended family share email addresses - nuts!
When I divorced my first wife it was amicable and we shared the solicitor (lawyer). But, sadly, many marriages and partnerships end in acrimony and I know someone whose wife got away with forging his signature and she wrote big cheques (checks) to herself and 'stole' all the money in their accounts.