Keeper Password Manager Discussion

Figured it was worth starting a thread for users who are using Keeper Password Manager. I'm taking a look at this as a possible replacement for LastPass due to recent security breaches with LastPass. A friend of mine suggested that he was using Keeper and was really happy with it.

I've setup a test account, on a Windows 11 VM, and am playing with the application to get a feel for how it works and if I like it. Keeper offers a 30 day trial of the software, which is what i am using.

One thing I did notice right off the bat is that the Keeper Desktop app was not known to the windows 11 smart app system, and therefore wasn't allowed to run if Smart app was enabled. Since I am just testing in a VM, and I had a previous snapshot/checkpoint, I just disabled the Windows 11 smart app feature to futher evaluate the keeper software.

Hi,
Think lastpass got hit once again

I was a Keeper user some years ago but deleted my data from their servers due to their subscription prices.

I've also used Keepass and now Keepass(XC) on and off but find it too cumbersome especially when accessing data om mobile devices or PCs other than my main desktop. Used it now as a safe archive. It is WAY safer than most PMs. I generated a key that is either copied to a folder on my PC or on a flash drive without which even the password can't decrypt the vault. KeepassXC has a prettier face if UI is important to you.

I find Sticky Password and Enpass (both lifetime subs) to be more user friendly. They're the best for local syncs but come with their own set of bugbears.

Settled for BW and 1Password for now.

Has anyone considered that all password management websites are a massive target for hackers. They might be difficult for hackers to crack but the rewards are enormous if they succeed. I would never use them. What I suggest is to create a spreadsheet, stored locally (not in the cloud) with a very strong master PW that contains all websites, usernames and PWs. Along with good AV and Firewall plus due diligence this sounds better to me. Yes, I know that hackers could crack this but why would they put the effort in for such small reward. They would only get access to one person's details instead of millions.

I know this is a debate that can go on so I won't be following this thread but I thought it might be worth pointing out the option of not using PW Manager websites. Good luck.

Beaupeep said:

I was a Keeper user some years ago but deleted my data from their servers due to their subscription prices.

Click to expand...

Yeah, that is something that I noticed right off the bat. I have the family plan for LastPass, so i am paying $4 a month billed annually. So, $48 for the year.

The family plan for Keeper is $74.99 and that provides 5 accounts. Thus, this is an increase of 56% in my annual cost.

wiganken said:

Has anyone considered that all password management websites are a massive target for hackers. They might be difficult for hackers to crack but the rewards are enormous if they succeed. I would never use them. What I suggest is to create a spreadsheet, stored locally (not in the cloud) with a very strong master PW that contains all websites, usernames and PWs.

Click to expand...

The issue I have with using something like a spreadsheet is that i need/want my passwords available to me on a variety of devices. I want access to them at home, at work, on my phone, while traveling, etc. This is the same reason that I moved from my ISP's email using something like Outlook and storing my email locally, to utilizing Gmail where I could access all of my email from all of my devices.

pparks1 said:

I'm taking a look at this as a possible replacement for LastPass due to recent security breaches with LastPass.

Click to expand...

That LastPass issue is concerning when you consider it was employee who their credentials stolen which allowed said breech. This just proves again, the weakest link in any security is the humankind.

That said, unfortunately this could have happened with anyone in any company so.....

And I agree with @wiganken, that any password management company are massive targets for hackers. Not just LastPass. Though we as customers don't want to hear that. We just hope whatever service we use is secure.

wiganken said:

Has anyone considered that all password management websites are a massive target for hackers. They might be difficult for hackers to crack but the rewards are enormous if they succeed. I would never use them. What I suggest is to create a spreadsheet, stored locally (not in the cloud) with a very strong master PW that contains all websites, usernames and PWs. Along with good AV and Firewall plus due diligence this sounds better to me. Yes, I know that hackers could crack this but why would they put the effort in for such small reward. They would only get access to one person's details instead of millions.

I know this is a debate that can go on so I won't be following this thread but I thought it might be worth pointing out the option of not using PW Manager websites. Good luck.

Click to expand...

Which is why on the Preferred Password Thread there has been support for Keepass.
It is NOT cloud based with a website interface, the database is stored on one's own device(s) and is much easier to use than a spreadsheet.

For those of you using password manager, this article is an eyeopener. Which Password Managers Have Been Hacked? – Best Reviews

I have used Roboform for many years and would not do without it. Since 2020 its server is encrypted with AES256, which is about the strongest encryption around. Anymore, all RoboForm data is encrypted and decrypted locally, never on servers.

I'm fairly sure everyone uses AES256 encryption.

That said, hard to do anything when an employee's credentials are stolen and used to access critical information. Unfortunately, this could happen to anyone, especially if they become a target - Why waste time hacking when you can just gain the credentials through nefarious means.

glasskuter said:

I have used Roboform for many years and would not do without it. Since 2020 its server is encrypted with AES256, which is about the strongest encryption around. Anymore, all RoboForm data is encrypted and decrypted locally, never on servers.

Click to expand...

This is exactly (except maybe the URL fields themselves aren't actually encrypted, but other things are). the same for LastPass.

pparks1 said:

This is exactly the same for LastPass.

Click to expand...

No app or site is 100% secure. I guess when you look at the odds, since 20014 Roboform beats Lastpass 7-2. Keepass has the same record as Roboform. Like any piece of software, One has to make the best informed decision they can and choos what works for them in terms of both security and ease of use.
If one is REALLY worried about it, one would choose to use 2-step verification for their master password. (I do not)

I used this link from Toms Guide: Get 40% off Keeper Unlimited and Keeper Family!

I have been using Keeper Security for just over a year. It works well, but I only recently discovered that it is doing something that I feel should be verboten for a password manager product. It is persisting my master password somewhere on my local storage so that, according to the company, they can 'help' me recover the passwords in my encrypted vault should I forget my master password.

They claim that they are encrypting this persisted copy of my master password using the answer to a security question. I don't care! A good password manager should NEVER be persisting a copy of the master password for the password vault - regardless of what kind of encryption might be employed!

I do no want Keeper Security to be able to 'help' me if I forget my master password because, if they can, it means that I am at risk of a brute force attack on that copy of my master password that they have persisted.

I've used LastPass for over 10 years and I've been quite happy with them. I'm still with LastPass because I know how their Zero Knowledge Architecture works. My password vault is encrypted locally on my PC and only the AES 256-bit encrypted vault is uploaded to the LastPass Server. LastPass never has or knows my Master Password.

Zero Knowledge Architecture was designed so that if the password vault were ever breached, it could not be decrypted. It worked as designed.

Even though the bad guys have my encrypted vault, it's useless to them, as I have an extraordinarily strong 26-character Master Password. It's also useless to them because I've now changed all my passwords and what they have only contains the old passwords.

I believe that current LastPass security is exceedingly high because of what they're going through. I'm confident they're safe going forward because of their Zero Knowledge Architecture, AES 256-bit encryption, and my strong Master Password.