Password Managers...

TheMystic · Jan 23, 2022

TairikuOkami said:
Whatever password manager you use, make sure that autofill is disabled by default, so the user's interaction only.
For example Bitwarden allows you to do it, it is one more click, but it is prevents scripts from stealing your passwords.
That is the reason I started to use Edge's password manager, because it requires UAC/PIN on a secure desktop for autofill.

View attachment 19556

Don't let your browser autofill your passwords — here's why

Autofilling passwords exposes them to any malicious script on a webpage

www.tomsguide.com

Yes, trust is important, like with emails or AV. I use MS so it can as well handle my passwords.
People can also choose an offline password manager like Keepass, preferably open source.

I store core passwords in a double encrypted document. Core passwords as for emails and such, because if hackers would gain access to emails, they could easily get access to any account via a password recovery. I have password check for leaks disabled, obviously.

Not really, it is a basic feature of any keylogger to grab clipboard (as well as screenshots), Keepass uses TCATO to fight it. Then again, if you use it, make sure to clear clipboard to prevent any webpage from reading it via a simple javascript, simply copy any gibberish afterwards. Bitwarden allows to set the time limit after which it is cleared automatically.

Thats why I use browser compartmentalization, as well as multiple profiles within each browser. Browsers that I use for login purposes, are used exclusively for just those sites. For all my searches and random browser activity, I use a separate browser so that any scripts that can bypass uBlock origin will still end up getting nothing.

TheMystic · Jan 23, 2022

Dark Knight said:
Main email account is not stored in the manager

Thats a good point. I might just create an email account that will be used exclusively for security purposes of all other accounts, and this account's credentials will not be stored in any password manager.

Dark Knight said:
To go as far as having a password manager to just copy and paste your login info into a website , well ........ whats the use ?

To avoid having to remember the passwords for so many accounts that one has these days. After a point, password managers seem to be the only convenient way, and therefore this post is about how best to make use of password managers, without having to give away the actual passwords to an unknown entity.

DigitalGoat · Jan 23, 2022

TheMystic said:
True. But easy to lose. And very inconvenient given what we have been used to.

My banks keep forcing me to change my passwords once every 120 days or so. And I keep forgetting them, so I have to use password reset each time. Can't afford this kind of inconvenience for the tens of accounts I have. So password managers provide some convenience in that respect.

Large corporations often perform cost-benefit analysis for non-compliance and they have influential lobbies to make sure laws have sufficient safeguards (aka loopholes) in place for them.

Yes paper and pen, easy to lose, about as easy as any system is to corrupt, backup media to die, service providers to go bust, accounts to be hacked etc.... what is your point here?

Your banks keep forcing you to change passwords? Really, because most banks may suggest to change passwords occasionally but force you to? And you keep forgetting them? Pen and paper, solved it.

And again a post which seems to be promoting paranoia against all corporations, I see a pattern throughout your posting.

TheMystic · Jan 23, 2022

DigitalGoat said:
Yes paper and pen, easy to lose, about as easy as any system is to corrupt, backup media to die, service providers to go bust, accounts to be hacked etc.... what is your point here?

Losing a piece of paper is more likely than all the others examples you have cited...the point is simple: technology is great but comes with its own set of risks. One must use maximum safeguards for their own interests, without making assumptions.

DigitalGoat said:
Your banks keep forcing you to change passwords? Really, because most banks may suggest to change passwords occasionally but force you to? And you keep forgetting them? Pen and paper, solved it.

Yes, they do. I keep getting locked out of my internet banking/ mobile app every 120 days or so. They force me to change passwords, and they won't allow me to reuse my last 3 passwords either. So I find it easier to reset them every 120 days than remembering 3 passwords for each account.

DigitalGoat said:
And again a post which seems to be promoting paranoia against all corporations, I see a pattern throughout your posting.

That's how you look at it. If ignoring potential risks works for you, all the best. I would continue doing my best to prevent and prepare, rather than repent and repair.

DigitalGoat · Jan 23, 2022

So show me the statistics on how papers or notebooks are lost more often compared to any other likely scenario. You can't because you are making an assumption.
If you were so interested in convenience as you claim, change banks because what they and you are doing just is not convenient I should imagine.
You seem to delight in making post under the guise of asking people for their preferred methods/ applications for a variety of tech related areas, then when people say what they do you insist they are wrong, misguided or ignoring the "risks" while you promote yourself as being seemingly more knowledgeable about how corporations work than anyone else on these forums.

Winuser · Jan 23, 2022

glasskuter said:
Ardent Roboform user for many years here. My master password is so long and complicated one app said it would take brute force 120 million years to crack it. Even if it was cracked I have nothing of any use to anyone. So if y'all see any naked photos posted here under my user name, you know my 120 mil. years are up.

I doubt they would go through all the trouble for a personal account, but it could be hacked in a more reasonable time frame. They have hacked into the computers of governments and corporations.

Wynona · Jan 23, 2022

markw51 said:
How is that tinfoil hat these days?

I knew it was going to happen sooner or later!

starchase · Jan 23, 2022

TheMystic said:
When people talk of privacy and security, a whole range of apps are discussed and checked/ scrutinized for issues related to privacy, security and vulnerabilities. But the category of app that is the single biggest risk (which knows every single character you type) often escapes the level of scrutiny that it truly deserves - the Keyboard app!

Likewise, a lot is said and written about password managers, and most of it are almost always positives. This is one app that is actually holding all your passwords - and therefore a very very big privacy and security risk! These apps not only know your password, but also any pattern that you may be using in creating passwords (if not using random passwords generated by such apps themselves). You are basically giving an unknown company all your passwords, as well as how your mind works in creating them. There have been security breaches in most reputed companies and millions of users have been affected by such security breach.

This post is not about security breaches. Instead, this is about the risks of you handing over your passwords to an unknown entity. Let's discuss what you do to secure your passwords and therefore your accounts.

Here's what I do:

1. All my banking (or financial) passwords are in my memory. I don't use password manager for this purpose.
2. I have enabled 2FA (two factor authentication) for pretty much all my accounts - email, cloud, social media, etc.
3. My password manager and 2FA apps are from different companies. This adds a layer of security to my accounts.
4. I don't use autofill service. Where required, I open the password manager, copy the password and then paste it in the password field. I do this for the following reasons:

I don't want the password manager to have direct access to the password field.

The passwords I save in the password manager are not the full passwords. My actual passwords are different (in that they have some additional/ missing characters) from the ones stored in my password manager. I add/ delete a few characters by following a certain methodology for each account somewhere in the passwords saved in the password manager. These characters (or string) could be added, for example, after a certain number of characters in the passwords stored in the password manager. Whatever logic or methodology is followed (which obviously I can't disclose; all i can say is it is unique and very unlikely to be forgotten), the resulting string of characters could be added after the 1st, 2nd, 3rd, and so on character in the passwords stored in the password manager, or they could occupy alternate places, or follow some other pattern. A similar exercise is followed if characters are deleted. Since there is a methodology followed, there is no way I can forget to arrive at the actual password. This way, I am able to use password managers to manage tens of accounts without actually giving them away to another entity.

Copy-pasting passwords (or more correctly, partial passwords) also help in protecting against keyloggers, if present.

I hope I have been able to explain the process.

What do you do to secure your passwords?

Everyone should have a hobby.

Wynona · Jan 23, 2022

DigitalGoat said:
1. So show me the statistics on how papers or notebooks are lost more often compared to any other likely scenario. You can't because you are making an assumption.

I actually have an address book I write everything in.

The Name is the name of the website, company, etc. The Address is the email account (I have several) I use for that particular entity. The next line gives the password (disguised) and so on.

And . . . I haven't lost my "address book" in all the years (at least ten) I've used this method.

Wynona · Jan 23, 2022

starchase said:
Everyone should have a hobby.

I do, I do, I do . . . I just love beta testing, no matter where it comes from!

Winuser · Jan 23, 2022

DigitalGoat said:
Your banks keep forcing you to change passwords? Really, because most banks may suggest to change passwords occasionally but force you to? And you keep forgetting them? Pen and paper, solved it.

I deal with a local bank and Yes, they do force me to change my password about every three months. I have to type in my old password and my new password twice. If accepted I'm aloud access to my account. Then they send me an email to let me know my password has been changed. If I try to login with a new or even updated browser I can't log in until I enter a code that gets emailed to me. I can only imagine what big banks do for security.

trevo · Jan 23, 2022

Keepass, laptops and phone, saved locally so offline...

Winuser · Jan 23, 2022

Wynona said:
I do, I do, I do . . . I just love beta testing, no matter where it comes from!

We have the same hobby. :) My wife's hobby is supposed to be crocheting. I think her real hobby is asking me "Now what did you buy for the computer?"

Winuser · Jan 23, 2022

For my passwords I use KeePass 2 and Dashlane.

Stigg · Jan 23, 2022

Enpass: Secure Passkey & Password Manager That Keeps Your Data On Your Cloud Storage

With Enpass, choose where your passwords and passkeys are secured and synced – on your personal or business clouds (or even offline). Not on our servers

www.enpass.io

Edwin · Jan 23, 2022

My default password manager...

BunnyJ · Jan 23, 2022

Edwin said:
My default password manager...

View attachment 19612

I use paper.. and it's worked for me forever

Winuser · Jan 23, 2022

BunnyJ said:
I use paper.. and it's worked for me forever

Another option for anyone that uses paper is save the passwords as a text file to a USB flash drive and do a printout and store the printout in a safe place. That way they would be able to use copy and paste to enter a password while not storing the passwords on the computer. The printed backup could be used if for some reason something happens to the USB flash drive. It would also make it easier to keep up with password changes. Just save the updated password text file and make a new printout.

BunnyJ · Jan 23, 2022

Winuser said:
Another option for anyone that uses paper is save the passwords as a text file to a USB flash drive and do a printout and store the printout in a safe place. That way they would be able to use copy and paste to enter a password while not storing the passwords on the computer. The printed backup could be used if for some reason something happens to the USB flash drive. It would also make it easier to keep up with password changes. Just save the updated password text file and make a new printout.

That too.. but I like paper

Winuser · Jan 23, 2022

BunnyJ said:
That too.. but I like paper

I'm thinking about keeping passwords secure and not having to type in a password. Most of my passwords are impossible to remember and even harder to type in.