What password manager would you recommend?

[Anonymous Bosch]

I signed the family up for Bitwarden. I'm the guinea pig during the free trial period. I find it is hit or miss on apps on my Pixel 2, but I really need to try more to make sure I'm doing it right. Some web pages it also has trouble recognizing I'm entering user/pass info and I have to go in and create my own card. Again, probably user error, but it's not clear what I'm doing wrong either. Still have 5 days left in the free trial - likely will keep it, just wish I could find more time to play with it.

If you haven't yet watched it, Bitwarden provides a useful video walkthrough on how best to configure and use it on Android devices:

[stessier]

I signed the family up for Bitwarden. I'm the guinea pig during the free trial period. I find it is hit or miss on apps on my Pixel 2, but I really need to try more to make sure I'm doing it right. Some web pages it also has trouble recognizing I'm entering user/pass info and I have to go in and create my own card. Again, probably user error, but it's not clear what I'm doing wrong either. Still have 5 days left in the free trial - likely will keep it, just wish I could find more time to play with it.

If you haven't yet watched it, Bitwarden provides a useful video walkthrough on how best to configure and use it on Android devices:

Thanks, I did watch that before deciding to go in that direction. Like I said, I think I need more time to play with it and figure out where I'm going wrong.

[Carpet_pissr]

I assume there is a setting in Android, like iOS, where you can force the OS to use a certain app? For iOS at least, for it to work well, you need to disable Apple’s built in PW manager. It will allow you to have more than one active, but it’s not ideal. This is something you have to manually do.

Might want to check any related options in Settings?

[Anonymous Bosch]

I assume there is a setting in Android, like iOS, where you can force the OS to use a certain app? For iOS at least, for it to work well, you need to disable Apple’s built in PW manager. It will allow you to have more than one active, but it’s not ideal. This is something you have to manually do.

Might want to check any related options in Settings?

Indeed, on Android devices you need to ensure you have "Auto-fill Service" & "Auto-fill Accessibility Service" both enabled in Bitwarden's settings. That way, Bitwarden will be correctly set to handle Android autofill username/password prompts.

If you're still having difficulty, here's another video that illustrates how to properly configure the above in more detail:

[Zaxxon]

I set up BitWarden this morning to give it a test (my LastPass Premium sub is up for renewal in April). So far, mostly so good--Android Autofill was a PITA, as I had to enable all options rather than just use the supposedly-now-available inline autofill from Gboard (I'm on a Pixel 5, current Android release).

Once I got that going, it works extremely similar to LastPass, except it also works properly on Vivaldi Android. LP would detect every site in Vivaldi as Vivaldi, which had kept me largely using Chrome on mobile even though I use Vivaldi on all my computers.

Promising start, and I like the cost that's 25% that of LP.

[LawBeefaroni]

Lastpass:

A security researcher is recommending against LastPass password manager after detailing seven trackers found in the Android app, The Register reports. Although there is no suggestion that the trackers, which were analyzed by researcher Mike Kuketz, are transferring a user’s actual passwords or usernames, Kuketz says their presence is bad practice for a security-critical app handling such sensitive information.

Not enough to make me leave it but combined with the new pricing model, I'm starting to look at alternatives.

[Blackhawk]

Yeah, they've jumped the ShArK3392!

[FishPants]

Yeah I have bitwarden downloaded, went to do the import and I get some error about there being more than 2 sets (organizations?) in my import and it won't allow that on the free version (still not sure wtf that means). I want to kick the tires of bitwarden and pay for the family plan there, but I'm running out of time and may just have to spend the money with Lastpass, although the trackers has really pissed me off - the sleaze level is high.

[Carpet_pissr]

I’m still shocked at how easy and painless the transition was. Per usual, about 4 days later (today), wife asks me “what’s the name of that app you mentioned that replaced LastPass?”

Not a heavy user I guess. I use that shit on average like 2x every hour, maybe more.

How anyone got on without pw managers before they existed, I’ll never know.

[Zaxxon]

Same here. The scary part is that 95% of people still get on without them. Given that it's functionally impossible to have acceptable account security in 2021 without one, that's terrifying.

[Anonymous Bosch]

Same here. The scary part is that 95% of people still get on without them. Given that it's functionally impossible to have acceptable account security in 2021 without one, that's terrifying.

Amen.

I've been using KeePass for well over a decade. It's crucial to remember that the worst thing one can do with passwords is to reuse the same one(s) across multiple sites. But according to a recent Virginia Tech study, that's precisely what 52 percent of people are doing. Which is hardly a surprise, considering how many people still do not use a secure password manager. Alas, if/when even one of those accounts gets compromised in a data breach, it doesn’t matter how strong your password is -- hackers can effortlessly use it to get into your other accounts. Which is why, aside from using two-factor authentication and keeping your Operating System and Web browser up to date, using a secure password manager is perhaps the most important thing you can do to protect yourself online.

[Zaxxon]

52%, LOL. The average person has 100+ online accounts. (I have 400+ in LP) They're using a password manager, or they are widely re-using passwords. I don't know of a third option.

[Isgrimnur]

Slightly different passwords.

[Zaxxon]

Slightly different passwords.

Works for 5, or 10 or 20. 100? The exact PW is re-used widely.

[Isgrimnur]

Two letter difference is 26^2. And that’s assuming each one only uses two letters.

[Anonymous Bosch]

52%, LOL. The average person has 100+ online accounts. (I have 400+ in LP) They're using a password manager, or they are widely re-using passwords. I don't know of a third option.

Absolutely.

I prefer going the extra step of using Abine's Blur service, which provides a masked phone number that forwards calls and messages to your actual phone number (and allows you to block/unblock any number from calling you with just a click), disposable private credit cards, and unlimited revocable anonymous spoof email addresses that forward to another email address. Suffice to say, I never have to faff around with spam filters and such. Spam rarely ever reaches my genuine email address, because each of my spoof email addresses are totally unique. So if a spammy email is ever fwd'ed, I know precisely which company sent it and can simply dispose of that email address, thereby preventing the spammy company from ever being able to reach me again. But needless to say, without a secure password manager, there's no way I'd be able to keep track of everything.

[Zaxxon]

Two letter difference is 26^2. And that’s assuming each one only uses two letters.

You're right; this is totally a math problem and not a human behavior issue.

[stessier]

52%, LOL. The average person has 100+ online accounts. (I have 400+ in LP) They're using a password manager, or they are widely re-using passwords. I don't know of a third option.

Rolodex. I didn't reuse passwords, just had them all written down. I had memorized the 5-10 that I needed when outside the house. Wasn't really a big deal.

[Zaxxon]

52%, LOL. The average person has 100+ online accounts. (I have 400+ in LP) They're using a password manager, or they are widely re-using passwords. I don't know of a third option.

Rolodex. I didn't reuse passwords, just had them all written down. I had memorized the 5-10 that I needed when outside the house. Wasn't really a big deal.

I'd argue that that's a password manager, just a really old-school one.

[stessier]

52%, LOL. The average person has 100+ online accounts. (I have 400+ in LP) They're using a password manager, or they are widely re-using passwords. I don't know of a third option.

Rolodex. I didn't reuse passwords, just had them all written down. I had memorized the 5-10 that I needed when outside the house. Wasn't really a big deal.

I'd argue that that's a password manager, just a really old-school one.

Fair.

[Blackhawk]

I absolutely do have a few easily-guessed single word passwords that I've been reusing for the last 15 years, and will continue to do so. They're used on sites, accounts, and apps that I might want to quickly sign into, don't really care about, and don't contain any personal or financial information. Throwaway accounts that, nonetheless, get saved in my password manager and add to the 'reused password' and 'bad password' statistics that are out there.

For anything that matters in the least, I have big, headache-inducing, unique alphanumeric strings, usually generated by LastPass (at least until now.) For anything I might need to sign into without a password manager (like, say, my wifi password) I use a system rather than randomness. It's sort of like an algorithm where you just need to remember the seed. I use unique passphrases with non-unique numbers inserted into them and a standard capitalization scheme.

So, say the number was 35718 (it isn't.) I might I always have a three-word (they aren't) phrase, say, 'purple monkey dishwasher'. I might always capitalize the second letter (I don't) and divide the numbers up as 35-71-8 (I don't.) Put together, that's: 35pUrple71mOnkey8dIshwasher All I'd really need to do is remember the three word phrase: and I could always reconstruct the actual password on the fly at near typing speed. The phrase is what makes it easy to remember; the numbers and caps are only there to interfere with dictionary attacks, so I'm not worried about them being too secret. You'd need all three factors to get in, and nobody cares enough about my accounts to go the amount of effort that would be required to create a custom dictionary attack that includes my number/caps system, even if they knew the numbers. There is security in irrelevance.

[Rumpy]

In the simpler days of early internet (ie 90's), I often re-used passwords. I think we all were a little naive, but of course as the internet got more complex and more focused on scripting, our passwords have had to get more complex and unique.

I more or less use a similar method, Blackhawk. Works for me and it's one of the easiest ways to provide something complex yet easily enough to remember within its context.

The worst are my parents. Trying to instill safer protocols in them and trying to get them to stop bad habits is like playing whack-a-mole. Some of it seeps in, but then there are times like with my Dad, where I discovered him using the same password on multiple websites, some of them quite important.

More than 10 years ago, I used to use a free mail forwarding service called SpamMotel, but I don't think it's around anymore. I did like being able to create new addresses whenever I signed up for something new and being able to just stop the flow if lots of spam came in.

[infinitelurker]

Earlier in this thread I stated I was happy enough with Lastpass and would stick with them so I didn't have to retrain my older family members who I provide tech support for. That is no longer the case.

When LastPass changed their free tier number of devices supported, I had planned on upgrading to the family plan. I did this, and opted for the free 1 month trial of the family plan, and then towards the end of it I went to pay for the upcoming year, only to be met with a hard error on the payment details page.

My LastPass account is really old, and goes back to when it was first available, and some of the billing data in that crashing page is 'off', like my email address being split across the first and last name fields, and stuff like that. I figured this may be the cause, so I logged in to their website rather than using the extension, and updating all my billing info. Go to upgrade the account - same error. Being a developer, I give it a day, thinking maybe some back-end process wasn't updating data to another system in a timely fashion. Nope. Next day, same error.

Ok, off to the support pages I go, figure out how to email them with the issue, and I settle in to wait. Two days later I get a 'we tweaked some settings, try again' response. I try again, same error. I respond to the email letting them know. That was over 3 days ago and I haven't heard anything since. Talk about tripping over the finish line. I've been a paid user for years, but never had to use support before.

So, yeah, I'm changing now. Currently looking at 1Password, the import seems to have gone perfectly, I'll give it a few days before moving forward.

[Carpet_pissr]

Earlier in this thread I stated I was happy enough with Lastpass and would stick with them so I didn't have to retrain my older family members who I provide tech support for. That is no longer the case.

When LastPass changed their free tier number of devices supported, I had planned on upgrading to the family plan. I did this, and opted for the free 1 month trial of the family plan, and then towards the end of it I went to pay for the upcoming year, only to be met with a hard error on the payment details page.

My LastPass account is really old, and goes back to when it was first available, and some of the billing data in that crashing page is 'off', like my email address being split across the first and last name fields, and stuff like that. I figured this may be the cause, so I logged in to their website rather than using the extension, and updating all my billing info. Go to upgrade the account - same error. Being a developer, I give it a day, thinking maybe some back-end process wasn't updating data to another system in a timely fashion. Nope. Next day, same error.

Ok, off to the support pages I go, figure out how to email them with the issue, and I settle in to wait. Two days later I get a 'we tweaked some settings, try again' response. I try again, same error. I respond to the email letting them know. That was over 3 days ago and I haven't heard anything since. Talk about tripping over the finish line. I've been a paid user for years, but never had to use support before.

So, yeah, I'm changing now. Currently looking at 1Password, the import seems to have gone perfectly, I'll give it a few days before moving forward.

I switched from LP to Bitwarden (also mentioned earlier in the thread), and wish I had done so much earlier. It's superior in every way in which I use it. Not to mention free.

[wonderpug]

I’ve also been happy with Bitwarden since making the switch.

[Zaxxon]

Thirded. I even paid up, just because they seem to deserve it.

[Blackhawk]

Also all of those things up there.

[infinitelurker]

I’ll have to take a look at bitwarden too, I cleared it from the list as soon as I saw people talking about self-hosting. I do enough tech work in my job, that I don’t want to add more to it, but I looked a little deeper last night and saw that is an option not a requirement.

[Zaxxon]

I’ll have to take a look at bitwarden too, I cleared it from the list as soon as I saw people talking about self-hosting. I do enough tech work in my job, that I don’t want to add more to it, but I looked a little deeper last night and saw that is an option not a requirement.

Yeah, and I don't think many take them up on it. Seems more for the uber-suspicious sort.

[Blackhawk]

Something new I've noticed a lot of sites doing suddenly - splitting the login info onto two pages. One page asks for your username/email address, then a captcha. The password is on a separate page.

This completely throws off Bitwarden, which apparently only identifies login pages based on them having a password field. Net result is having to manually look them up each time I visit such a site.

[Anonymous Bosch]

Something new I've noticed a lot of sites doing suddenly - splitting the login info onto two pages. One page asks for your username/email address, then a captcha. The password is on a separate page.

This completely throws off Bitwarden, which apparently only identifies login pages based on them having a password field. Net result is having to manually look them up each time I visit such a site.

I don't know if there is something similar to this in Bitwarden, but the Auto-Type feature in KeePass handles these situations perfectly. Because it allows you to freely define your own custom sequence of keypresses, which KeePass can automatically perform for you. For example, a simple script like this works for the two page log-in sequence on Amazon:

Code: Select all

{USERNAME}{ENTER}{DELAY 2000}{PASSWORD}{ENTER}

In practice, this means you place your cursor in the relevant username textbox and then hit your Auto-Type hotkey, which executes the relevant script for that site. What that script translates to, is KeePass automatically 'types in' the relevant username for that site -- using Two-Channel Auto-Type Obfuscation to thwart keyloggers -- and hits enter, waits 2,000 milliseconds (i.e. 2 seconds), automatically 'types in' the passphrase and hits enter again, and you're logged in. For those pesky sites that force you into entering a CAPTCHA just to sign-in, you enter the CAPTCHA first, then place your cursor in the first field and press the Auto-Type hotkey to execute your defined Auto-Type sequence from there.

EDIT: Looks like Bitwarden Auto-Type provides similar functionality to what I described above.

[stessier]

Something new I've noticed a lot of sites doing suddenly - splitting the login info onto two pages. One page asks for your username/email address, then a captcha. The password is on a separate page.

This completely throws off Bitwarden, which apparently only identifies login pages based on them having a password field. Net result is having to manually look them up each time I visit such a site.

Do you have an example of one? I thought it still identified the right credentials whenever that happened to me.

[Carpet_pissr]

Something new I've noticed a lot of sites doing suddenly - splitting the login info onto two pages. One page asks for your username/email address, then a captcha. The password is on a separate page.

This completely throws off Bitwarden, which apparently only identifies login pages based on them having a password field. Net result is having to manually look them up each time I visit such a site.

I use BW and have not come across that problem. Maybe a setting you changed from default?

[Zaxxon]

Something new I've noticed a lot of sites doing suddenly - splitting the login info onto two pages. One page asks for your username/email address, then a captcha. The password is on a separate page.

This completely throws off Bitwarden, which apparently only identifies login pages based on them having a password field. Net result is having to manually look them up each time I visit such a site.

Do you have an example of one? I thought it still identified the right credentials whenever that happened to me.

Same. Sometimes I have to tell it to fill, but it's never gotten confused about what to fill.

[Authority924]

Spam deleted