Which is your preferred password manager software? 2nd Edition. New and improved

pparks1 · Sep 5, 2023

Scannerman said:
My preferred password management software isn't on that list.

It's called My Little Black Book.

It's entirely analog and requires some academic knowledge of coding, such as an alphabet and base 10 mathematics.

Specialized hardware, such as a pen or a pencil, and a notebook, are essential.

Some organizational skills are beneficial when running this software and it must be run by a cognizant, sentient, biological entity.

Bots, root kits, rats, and Trojans are incapable of running this highly specialized software.

Since I've used it my system has remained reasonably safe from malware and other malicious entities.

Anyone interested in this software is welcome to privately message me and I will tell them how they can get started with it.

But for somebody like me, I would have to carry around this little black book with me when I go to work, and any time I was on my phone and out of the house. And I would have to also carry a black book for my wife's sites, user names and passwords.

I have nearly 200 passwords in my own password vault. Most are 20 characters+, and are randomly generated, all have special characters and none of them are the same. Using a notebook with all of this written down is simply not feasible..

Given a choice, my family members if they didn't use a password manager would just use the same username/password on all websites. They aren't going to remember tons of different passwords. I feel confident that using the same password repeatedly is going to turn out far worse then using a password manager with unique passwords for all sites.

TraderGary · Sep 5, 2023

Stigg said:
Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach – Krebs on Security

krebsonsecurity.com

You have to smile at the author's quote halfway through the article:

"I’ve never been comfortable recommending password managers, because I’ve never seriously used them myself. Something about putting all your eggs in one basket. Heck, I’m so old-fashioned that most of my important passwords are written down and tucked away in safe places."

Scannerman · Sep 5, 2023

The Missuz uses a little pink book too.

I hear it's just as effective and I believe it as she hasn't had any issues with it either.

Admittedly, sometimes the analog process takes a while and can get somewhat annoying but better to be safe than sorry because one trusted some stranger with their essential information only to see it fall into the wrong hands. Indeed, it's very wise to have that primary password memorized and equally important NOT to use that password for anything else. This alone will provide a second tier of security when one engages in using this highly sophisticated software.

pparks1 · Sep 6, 2023

I still cannot do it without a password manager. Mostly because I resorted to long passwords generated completely at random. I haven't the slightest clue what most of my passwords are and they are all different.

Just the other day, wife and I were out at a friends hour and our son was home alone. He wanted pizza, so he sent me a text message. I logged into the local pizza joint with my phone, hit login and it supplied my username/password, i ordered the pizza and we had it delivered. Sure, I could have called on the phone. Sure, I could have hit FORGOT PASSWORD and went through the reset process. Sure, I could have made my pizza password something really easy to remember.

Two days ago, wife and I went to a concert. The tickets were in the ticketmaster app on my phone. Had to login at the gate for them to scan my barcode to get in. Again, password manager had my credentials stored for me and I was all set.

I even back up my password manager from time to time, because I truly don't know all of the websites I have registered for, nor about 99% of my passwords. I'd be lost without it.

antspants · Sep 6, 2023

pparks1 said:
Sure, I could have made my pizza password something really easy to remember.

Pepperoni123

Wladimir Palant · Sep 6, 2023

TraderGary said:
The author apparently does not understand how "zero knowledge architecture" and hashing algorithms work. He should know that the hashing algorithm used by LastPass cannot be reverse engineered to obtain a user's password. As far as I know, all password managers are based on the same "zero knowledge architecture".

I happen to be the author of this article, and I assure you that I understand “zero knowledge architecture” perfectly well. I also know that this isn’t what LastPass (unlike other password managers) actually uses, regardless of what their PR claims. I’ve reported a number of LastPass security issues over the years, and e.g. their change to 100,100 iterations as well as stricter master password requirements in 2018 were the result of my report.

You should really read up on how password cracking works. Hashing algorithms cannot be reversed in a traditional sense, but they can be bruteforced by trying out various password guesses in order to find the one producing the right hash. That’s why it is essential that the hashing algorithm is as slow as possible.

antspants · Sep 6, 2023

Wladimir Palant said:
I happen to be the author of this article, and I assure you that I understand “zero knowledge architecture” perfectly well.

Welcome to our planet, I hope the passage from planet Linux was a comfortable one.

Wladimir Palant · Sep 6, 2023

antspants said:
Welcome to our planet, I hope the passage from planet Linux was a comfortable one.

Don’t worry, I still keep Windows in a VM. In fact, I even wrote an article on how one can quickly set up a throw-away Windows VM for trying out software you don’t quite trust.

TraderGary · Sep 6, 2023

Wladimir Palant said:
I happen to be the author of this article, and I assure you that I understand “zero knowledge architecture” perfectly well. I also know that this isn’t what LastPass (unlike other password managers) actually uses, regardless of what their PR claims. I’ve reported a number of LastPass security issues over the years, and e.g. their change to 100,100 iterations as well as stricter master password requirements in 2018 were the result of my report.

You should really read up on how password cracking works. Hashing algorithms cannot be reversed in a traditional sense, but they can be bruteforced by trying out various password guesses in order to find the one producing the right hash. That’s why it is essential that the hashing algorithm is as slow as possible.

I apologize for my comment as I had based it on your comment in the "Who I Am" section on your web page where the article is posted. You state, and I quote, "Despite researching security topics since at least 2007 I still do it as a hobby rather than my job."

pparks1 · Sep 6, 2023

In June of this year, I got an email from LastPass saying

LastPass recently upgraded the security of your LastPass account. Specifically, the default PBKDF2 iterations protecting your LastPass master password has been set to 600,000.

I checked my account and sure enough, it had increased from the 250,000 that I previously set to 600,000.

My password entropy is greater than 120. I have about 20 logins that I consider sensitive, and I change them regularly. I change my master password from time to time as well. Not sure I can do much else except memorize all of my passwords (which isn't going to happen).

Steve C · Sep 6, 2023

None since I don't trust any of them. I have my own trusty method which uses an air gap.

Wynona · Sep 6, 2023

kelper said:
After some very valid criticism of the previous poll, I have decided to try again. I have just re-read every post in the old thread and noted all the password managers mentioned in the comments. As I can only have ten possible responses I don't want "Other" or "None of the above"
I have also checked a lot of reviews from the likes of Tech Radar, PC World, PC Magazine, Tom's Guide, CNET and many others.
Once posted, I can not edit the question or the possible responses!
I have opted to not show the poll until you have voted because I don't want you to be influenced before voting!

None of the above, which isn't included in the survey.

I use my own system and haven't been hacked. I think I've had a virus a couple times, and that's been a long, long, long time ago.

Wladimir Palant · Sep 6, 2023

pparks1 said:
In June of this year, I got an email from LastPass saying
I checked my account and sure enough, it had increased from the 250,000 that I previously set to 600,000.

Another person reported receiving a similar email in 2019. So the mechanism to upgrade existing accounts seems to exist. Why it is only being used to upgrade a tiny fraction of the affected accounts is beyond me.

TraderGary · Sep 6, 2023

I've had LastPass for over 10 years and I've also gotten notifications when upgrades have been made. I've never had a reason to not be satisfied with my family subscription to LastPass.

Edwin · Sep 6, 2023

@antspants
Check this out just for curiosity... Password Manager
It's no longer developed, no longer supports extensions, but, it works fine on a Local level.
I don't even think the app phones home!

antspants · Sep 6, 2023

Edwin said:
@antspants
Check this out just for curiosity... Password Manager
It's no longer developed, no longer supports extensions, but, it works fine on a Local level.
I don't even think the app phones home!

View attachment 70108

Cheers, Mate, I’ll take a look. But logging into sites is kind of better with extensions as apposed to copy/paste. How lazy am I?

1Password 4 works great still. But, I have to install it offline and disable updates or it force updates to 7, which is subscription/cloud based.
I also have to do the same when adding the old extension into Firefox or that also automatically updates to 7.
On IOS it still works, but i have no control over the extensions/app upgrades. It still reads my synced vault, for now. But I can see small changes that are causing it to be stubborn sometimes.

Stigg · Sep 8, 2023

Wladimir Palant said:
I happen to be the author of this article, and I assure you that I understand “zero knowledge architecture” perfectly well. I also know that this isn’t what LastPass (unlike other password managers) actually uses, regardless of what their PR claims. I’ve reported a number of LastPass security issues over the years, and e.g. their change to 100,100 iterations as well as stricter master password requirements in 2018 were the result of my report.

You should really read up on how password cracking works. Hashing algorithms cannot be reversed in a traditional sense, but they can be bruteforced by trying out various password guesses in order to find the one producing the right hash. That’s why it is essential that the hashing algorithm is as slow as possible.

Welcome to the forum, Wladimir.

Pnokio · Sep 8, 2023

I am at present using LastPass & Dashlane. They are both super secure, I can't access my Electricity account on either and i have the correct password

TraderGary · Sep 8, 2023

Pnokio said:
I am at present using LastPass & Dashlane. They are both super secure, I can't access my Electricity account on either and i have the correct password

Does your Electricity account have an option to reset your password? Usually its a clickable that says something like "forgot my password".