this post was submitted on 14 Aug 2024
598 points (96.3% liked)

Privacy

34089 readers
181 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can't remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn't tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.

Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don't just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They're not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser's password storage is better than nothing. Don't reuse passwords, use long randomly generated ones.

It's free, it's convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I'm preaching to the choir, but if even one of you decides to use a password manager after this then it's an easy win.

Please, don't wait. If you aren't using a password manager right now, take a few minutes. You'll thank yourself later.

(page 4) 50 comments
sorted by: hot top controversial new old
[–] [email protected] 5 points 6 months ago

Why preach to this choir? I get you, but we also get it.

[–] [email protected] 12 points 6 months ago* (last edited 6 months ago) (11 children)

Using 2FA on all accounts that offer it is just as important. And make sure to use a good, open-source TOTP client like Aegis on Android or Tofu on iOS.

Definitely make sure to backup your seeds in an encrypted format (e.g. Veracrypt container or GPG-encrypted files). If you lose your seeds, you lose access to your accounts.
I like to use the automatic backup feature in Aegis, which syncs my encrypted vault to my Nextcloud server. You can also enable compatibility with Android's backup API and use that if your ROM includes a backup solution like Seedvault.

load more comments (11 replies)
[–] [email protected] 3 points 6 months ago (6 children)

Whatever solution you think you can come up with is most likely not secure.

Having my passwords written down on a piece of paper is not safe ?

load more comments (6 replies)
[–] [email protected] 5 points 6 months ago* (last edited 6 months ago) (10 children)

So many folks talking about which software they use, and how they sync it between devices etc.

You all know there are hardware password keepers right? They present to your devices as a usb and/or bluetooth keyboard and just type out the user/password that you select. They have browser plugins to ease the experience. Now your password is not even stored on the device you're using to perform your login and it will work on any modern device even without internet access.

Oh and no subscription fee to cover the costs of cloud infrastructure.

load more comments (10 replies)
[–] [email protected] 18 points 6 months ago (1 children)

I have a password manager with a family plan so my wife can use it. Does she? Absolutely not. And that's why we don't share bank accounts.

[–] [email protected] 3 points 6 months ago (1 children)

Same and she has the balls to ask me for passwords!

[–] [email protected] 2 points 6 months ago

Same here. Kinda feels good to know I am not alone with this, though.

[–] [email protected] 16 points 6 months ago (3 children)

I blame the tinfoil hat infosec crowd for not understanding that the world they inhabit is not the same one Regular Users live in.

Is there risk in keeping all your passwords in one place, whether it's on your hardware or someone else's? hell yes! Is that risk stastically speaking ANYTHING LIKE the risk you take when you use 'pencil' for all your passwords because you can't be arsed to memorize anything more complex? OH HELL YES.

Sure, if you're defending against nation state level agressors, maybe using a password manager isn' the wisest choice, but for easily 99% of computer users, we're at the level of "keeping people from drooling on their shoes". So password managers are probably a GREAT idea.

load more comments (3 replies)
[–] [email protected] 8 points 6 months ago (4 children)

I don't even understand why I need to make a password for some sites anymore. They send a code to my phone everytime.to make.sure it's me so it seems like there's practically no point.

[–] [email protected] 7 points 6 months ago

Because different layers protect you against different things. It's like how you have anti-lock brakes, a seatbelt, an airbag, and crumple zones on your car. You don't just have one thing to protect you.

[–] [email protected] -3 points 6 months ago (1 children)

2FA really stands for

2 FUCKING ANNOYING !!!

[–] [email protected] 6 points 6 months ago (14 children)

Do you not understand how much 2FA helps you? That shit is cash money.

load more comments (14 replies)
load more comments (2 replies)
[–] [email protected] 12 points 6 months ago* (last edited 6 months ago) (3 children)

I've been using Proton Pass and it has been a game changer for me. Hot take: I think Proton Pass is Proton's best service.

It creates not only a unique password for each service but also a unique email address alias. If a website leaks my email address and I get spam, I know exactly who did it and I only need to swap 1 login credential.

Has a built-in 2FA and passkeys. Works great in the browser with proper auto complete, even for the 2FA code. Works fine on Android and password in both browser and applications get autocomplete.

Proton Pass can be used by everyone, regardless of their technical level, in every device. My mom could easily use this across all her devices. I'm told Keepass is fantastic but having it sync across all her devices would be challenging for her.

Most Proton services feel kinda underbaked but Proton Pass is excellent.

[–] [email protected] 6 points 6 months ago (1 children)

I'm a little miffed that 2FA support is a paid feature.
I'm using KeePassXC and have no intention of switching, plus I'm paying for an account anyway, I just feel that 2FA is such an essential feature for a password manager that it shouldn't be locked behind a paywall.

[–] [email protected] 1 points 6 months ago

100% agree. Charging for the unlimited email alias is fine but 2FA? :/

[–] [email protected] 4 points 6 months ago (1 children)

If that wasn't a scripted ad, you should go into sales.

[–] [email protected] 5 points 6 months ago* (last edited 6 months ago)

I have worked in retail to help pay for university. It was a miserable job. Dealing with people made me a worse person.

I am very "passionate" about Proton Pass but don't take me for a Proton chill, I have a lot of criticism about their other products.

load more comments (1 replies)
[–] [email protected] 4 points 6 months ago (4 children)

I have been using password gestoires for a long time. First LastPass, until I switched to GNU/linux and discovered Keepass and then KeepassXC.... For me they are indispensable. That's the one I used until about 1 year ago when I started having problems with the Firefox addon. It did not recognize the pages. I tried ProtonPass and I like it, but I don't like having them online, no matter how secure the site is. I've tried going back to KeepassXC, locally, but the file I export from ProtonPass won't load in KeepassXC. I feel stuck.

Translated with DeepL.com (free version)

[–] [email protected] 1 points 6 months ago (1 children)

Did you export ProtonPass to CSV?

load more comments (1 replies)
load more comments (3 replies)
[–] [email protected] 14 points 6 months ago (1 children)

On the plus side, the more people who don't use password managers the more chance us password manager users will remain not worth the effort.

It's kinda like security through obscurity mixed with only having to be faster than the slowest person to outrun a lion.

load more comments (1 replies)
load more comments
view more: ‹ prev next ›