Which is your preferred password manager software? 2nd Edition. New and improved

Kelper;
The only problem here is that all websites require a password eight characters long and with upper case and lower-case letters with at least two numbers. If websites would adopt Steve Gibson's concept it would be a highly effective weapon against hacking passwords but, unfortunatly, until that day comes, we're stuck with what we got, and passwords will be hacked. I will bookmark his page as it has a great concept of how to really create a password.

I have 170 sites in my password manager. All site passwords are currently 20 or more characters long. My Master Password is currently a passphrase of 26 characters.

@xpac5896

I just wanted to make the point that the most important way of making a strong password, is to add length, rather than complexity.
I agree that we are bound by each websites silly rules.

Not sure if it's been mentioned but Last Pass had a big data leak recently.


Edit - read back and it has been mentioned - the article is useful though.

I use Firefox with a master password.

I just moved to BitWarden after the latest about LastPass, which I had used for years. I still used the built-in password manager within my browser, which seems to work really well, but I do like to store my passwords in the cloud for use if I'm on another computer.

With the Firefox one, if you have a Firefox account, you can access everything on any computer . Just by signing into the firefox account. Bookmarks, passwords, the lot. A master password means no-one else using the computer can access your passwords.

After spending a good bit of time with both Bitwarden and 1Password, I've decided to stay with LastPass. They all use the same standard Zero Knowledge Architecture and the same AES 256-bit encryption. Even though LastPass was breached, if your Master Password is strong, as it should have been, you are safe. That's the whole reason for having Zero Knowledge Architecture in a password manager. A breach can happen to anyone. Even though the bad guys have an old copy of the vault, they can do nothing with it without having Master Passwords and of course they have nothing if passwords have been changed since the breach.

The stories say encryption keys were stolen. I don't believe that, do you?

Allow me to bring you up to speed on my situation...,
As stated previously, I voted 'My browser', (Chrome), which I'm confident is capable of managing efficiently, the meager 20, or so, credentials that I use on a daily basis, and mostly for casual browsing and research, etc., only.

Everyone's situation is unique and, everyone has different needs...,
me..., I'm a middle aged, non-professional who doesn't necessarily need to be connected while at work, or any other place, for that matter.
I live alone..., no one else has access to any of my devices at any time, whether I'm in my truck, at the grocery store, at church, sitting on the can or in the shower!!!
I don't do banking or government transactions online, (although, that might change soon due to the fact that it's becoming a real p-i-t-a!!!)

However...
... thanks to the insightfulness of @kelper , @TraderGary and others, I no longer use a simple notebook to store my approximate 150 credentials!
I now have all of them stored on an encrypted notepad, on a thumb drive, sealed in an indestructible metal capsule...,
and also on an encrypted NoteKeeper app for PC and Android.

That pretty much covers my needs..., your mileage may vary, but, thank you all for your insights, it's been an education!!!

kelper said:

The stories say encryption keys were stolen. I don't believe that, do you?

Click to expand...

LastPass used a separate cloud storage for data backups. Before the backups, including users LastPass vaults, were stored, they were further encrypted with a proprietary binary encryption. The key to this encryption is what the threat actor got. After this decryption was done with the stolen key, the vault would still be fully protected by the AES 256-bit encryption that was done by the user's PC before it was ever uploaded to the LastPass servers.

The stories saying that encryption keys were stolen adds a whole lot of sensationalism and click-bait, doesn't it?

I saw this story yesterday and I checked on the Bitwarden Forum and the website mentioned in the story no longer exists. Someone is using Google Ads to tempt people into clicking on an ad instead of going to the legitimate website. 1Password was targeted as well.
Another reason for using ad blockers.

The forum members have certainly put a different slant on the poll after the LastPass breach. LastPass is currently down to only four votes, including mine. I wonder what effect the breach is going to have on the 33 million subscribers to LastPass? I mentioned it to a friend and the response was "what breach?".

For those who may be using Bitwarden, here's an update. Their KDF function now has the option of using Argon2d algorithm w.e.f today 4 am GMT. Wait till your apps and browser extensions are updated to 2023.2.0 before you change the algo.

Why would I want to change?

TraderGary said:

My Master Password is currently a passphrase of 26 characters.

Click to expand...

That would be problematic for me since my working memory is only something like 7 characters!

kelper said:

Why would I want to change?

Click to expand...

To increase the difficulty in hacking attempts to decrypting your password. It costs you nothing but a little effort to make this change which enhances your security, so why not do it.

I asked Bing's new AI for an opinion.

Is Argon2ID better than "PBKDF" SHA-256?


Argon2ID is generally considered to be better than PBKDF SHA-256 for password hashing. PBKDF SHA-256 is a password-based key derivation function that uses SHA-256 as the underlying hash function. It is designed to be slow and resistant to brute-force attacks, but it has some drawbacks compared to Argon2ID1.

First, PBKDF SHA-256 is not memory-hard, meaning that it does not require a lot of memory to compute the hash. This makes it vulnerable to attacks using specialized hardware, such as ASICs or GPUs, that can perform many hashes in parallel with low memory cost2.

Second, PBKDF SHA-256 is not side-channel resistant, meaning that it can leak information about the password or the hash through physical measurements, such as power consumption, timing, or electromagnetic radiation. This can allow an attacker to recover the password or the hash without brute-forcing it2.

Argon2ID, on the other hand, is a memory-hard and side-channel resistant password hashing algorithm

Good little survey you have going @kelper.
Multiple choice answers for your next release?

I use the browsers backed up by Keepass.