• just another dev@lemmy.my-box.dev
    link
    fedilink
    English
    arrow-up
    160
    arrow-down
    2
    ·
    3 months ago

    I guess now is as good a time as any for them to start using a proper password manager.

    Personally, I recommend Keepass - it has multiple clients for all platforms, and you can keep the file in sync with a program of your own choosing, like Dropbox, syncthing or whatever you like.

    • GissaMittJobb@lemmy.ml
      link
      fedilink
      English
      arrow-up
      65
      arrow-down
      3
      ·
      3 months ago

      Bitwarden is probably a more pragmatic choice for most users, given that it’s free and without having to manage the syncing yourself.

      Any password manager is better than the alternative, though.

      • 🅿🅸🆇🅴🅻@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        arrow-down
        14
        ·
        edit-2
        3 months ago

        I’m not sure what you’re comparing it to. Keepass is free too, in fact it’s open source. In my opinion, local software and database that is under your control is always superior to cloud.

        Keepass over Bitwarden offers a lot of plugins and integrations, again, if you want more customization or automation.

        But, I would say you can use any online password manager as long as it’s end to end encrypted, so Bitwarden is a good choice.

        • evulhotdog@lemmy.world
          link
          fedilink
          English
          arrow-up
          28
          ·
          3 months ago

          I think your bias may be showing. The average computer user doesn’t even think about using a password manager. It just exists and works in their browser.

        • GissaMittJobb@lemmy.ml
          link
          fedilink
          English
          arrow-up
          21
          arrow-down
          2
          ·
          3 months ago

          Also, local software and database is always superior to cloud.

          Now there’s an unfounded blanket statement if I ever saw one.

          • Enoril@jlai.lu
            link
            fedilink
            English
            arrow-up
            3
            ·
            3 months ago

            Statement related to previous cloud hacks i assume.

            Should have say: self-hosting is always superior to cloud hosting.

            Bitwarden (the client) + Vaultwarden (the self-hosted server) is a good combo if you have some knowledge on how to setup it.

            • GissaMittJobb@lemmy.ml
              link
              fedilink
              English
              arrow-up
              7
              ·
              3 months ago

              Should have say: self-hosting is always superior to cloud hosting.

              That statement still comes with a pretty damn big caveat though - you need to have the know-how, the time to invest and the hardware (i.e money) to actually set something like this up.

              If all of those are true, then self-hosting can definitely be an attractive option for you.

              It’s only true for a vanishingly small fraction of the population, though.

              Hence, Bitwarden is a pragmatic solution that will be superior for the vast majority of the population.

        • fmstrat@lemmy.nowsci.com
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 months ago

          No dislike for Keepass here, but I prefer Bitwarden. It’s also super easy to self host with Vaultwarden.

      • NekuSoul@lemmy.nekusoul.de
        link
        fedilink
        English
        arrow-up
        21
        ·
        3 months ago

        Most amazingly, this setup is also unexpectedly resilient against merge conflicts and can sync even when two copies have changed. You wouldn’t expect that from tools relying on 3rd party file syncing.

        I still try to avoid it, but every time it accidentally happened, I could just merge the changes automatically without losing data.

        • Shatur@lemmy.ml
          link
          fedilink
          English
          arrow-up
          11
          ·
          3 months ago

          How did you enable merge conflict resolution for KeePassXC databases?

          • NekuSoul@lemmy.nekusoul.de
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            3 months ago

            Depends a bit on the clients.

            • KeePass: Will ask you if you want to synchronize/overwrite/discard the database when saving.
            • KeePassXC: Will autoreload the database in the background, so merge conflicts shouldn’t happen in the first place. Otherwise there’s ‘Merge database’ in the menu.
            • KeePass2Android: So I mixed up the names and this is the client I actually use. This one does all changes to an internal copy of the database that is then synchronized on request.
            • KeePassDX: As far as I can see it also has a mechanism similar too KeePass2Android.

            Assuming you only have one desktop and mobile client you should never run into any issues. If you do have multiple KeePassXC clients it’s all fine as well assuming Syncthing always has another client it can sync with.

      • OfficerBribe@lemm.ee
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        I store my DB in Dropbox and use KeePass2Android on phone which has built in Dropbox sync.

      • GoJimi@lemm.ee
        link
        fedilink
        English
        arrow-up
        17
        ·
        3 months ago

        Exactly! Self hosted FTW. Chances of a data breach… Typically pretty minor if you are smart.

        • Pennomi@lemmy.world
          link
          fedilink
          English
          arrow-up
          20
          arrow-down
          1
          ·
          3 months ago

          Chances of losing the data is higher with selfhosting too. Unless you’re doing some sort of multizone replication, or course.

          • nialv7@lemmy.world
            link
            fedilink
            English
            arrow-up
            10
            ·
            3 months ago

            I use syncthing so there’s a copy of my password database on each of my devices.

          • communism@lemmy.ml
            link
            fedilink
            English
            arrow-up
            5
            arrow-down
            1
            ·
            3 months ago

            I would rather lose my passwords than have my password database be accessed by someone else. Most websites have a “forgot password” function, and for passwords that don’t have that (e.g. to decrypt my hard drive or log into my computer) I’ve memorised the passphrase and always type it manually anyway. And for passwords where neither applies, it’s probably not a huge loss anyway if I’ve not prepared for the possibility of losing my password db for that particular password.

          • GoJimi@lemm.ee
            link
            fedilink
            English
            arrow-up
            4
            ·
            3 months ago

            Yeah. Daily and weekly cloud backups solve that for myself for sure.

          • Lem453@lemmy.ca
            link
            fedilink
            English
            arrow-up
            3
            ·
            3 months ago

            Borg backup to borgbase is not very expensive and borg will encrypt the data plus the vault is also encrypted

          • The Pantser@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            3 months ago

            I am hosting on Home Assistant which itself gets a backup to my Google drive and my personal machine. So there are two backups, as long as HA doesn’t create a corrupted backup 3 weeks in a row I am good.

          • Russ@bitforged.space
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 months ago

            As long as you’re still signed into BW from any of your devices, you can always export the vault from there.

            (But yes, actual backups are always a plus)

        • Lem453@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          Keep vaultwarden behind wireguard for local only access then also use https certs and good master password. Very secure like this

            • Lem453@lemmy.ca
              link
              fedilink
              English
              arrow-up
              2
              ·
              3 months ago

              Security in layers.

              All your services should be using https. Vaultwarden in particular won’t even run without https unless you bypass a bunch of security measures.

              This is how to setup local only and external https, I highly recommend this as a baseline setup for every homelab. It allows you to choose how much security you want on a per app basis and makes adding new apps trivially easy.

              https://youtu.be/liV3c9m_OX8?si=TSWXoN_8SJDpAHaW

      • N1ghtstalk3r@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        ·
        3 months ago

        +1 for a self-hosted Vaultwarden instance. If you’re technically capable and have extra hardware laying around this is the best way to go.

      • just another dev@lemmy.my-box.dev
        link
        fedilink
        English
        arrow-up
        21
        ·
        3 months ago

        If you never, ever need your passwords outside of your home, that’s great advice - it’s as secure as can be against digital theft. Less so against fire though, and backups are out of the question.

        • Shdwdrgn@mander.xyz
          link
          fedilink
          English
          arrow-up
          14
          arrow-down
          1
          ·
          3 months ago

          I just store all my passwords in robots.txt on my web server, makes it easy for me to access them anywhere I go…

          /s

        • thejoker954@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          ·
          3 months ago

          Backups are easy? Just copy to another piece of paper and store somewhere else.

          I’m just being facetious though.

          • just another dev@lemmy.my-box.dev
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            3 months ago

            I’m not being facetious though. Off-site backups of a digital password collection are easy to setup and maintain. But when you change your password or add a new entry, it’s going to be a pain in the ass to have to drive over and update a physical copy.

            If you can live with those downsides, that’s fine. But in my opinion it would be facetious to pretend a physical backup is “just as good/usable” as a digital one.

            -edit: whoops, misread that as implying that I was being facetious. As you were sir -

        • aname@lemmy.one
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 months ago

          I have a firesafe at home for important papers, passports and some emergency cash. I keep my passwords there.

        • nous@programming.dev
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          1
          ·
          3 months ago

          You can have backups of physical books. Just copy the text from one to the other. Yeah it is manual work but so is writing the first one in the first place. You can then store the second copy in a fire resistant safe or at a friends or family members house (maybe inside a safe as well).

        • tabular@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          2
          ·
          3 months ago

          Well you can write a copy and keep it in a shed if it’s unlikely to also catch fire.

      • Ilovethebomb@lemm.ee
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        3 months ago

        This is the first suggestion here that’s actually within the technical abilities of most people, even most Lemmy users.

        The level of technical knowledge some of people here seem to think the general public has is absurd.

        • tabular@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          I’m usually the one promoting technical literacy to all but in this case I honestly don’t use a password manager.

          • Ilovethebomb@lemm.ee
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            It’s honestly seemed like more trouble than it’s worth, there’s a few websites where I just reset my password every time.

            • Hexarei@programming.dev
              link
              fedilink
              English
              arrow-up
              1
              ·
              3 months ago

              The thing that makes it worth it to me is long, randomly generated passwords that I don’t have to know.

              None of the sites and services I use require me to type out a password thanks to browser integration and auto type (for desktop apps and such), along with autofill service on android.

              Then along with that I can even store other things like account recovery codes (for 2fa) or security questions (which also get randomly generated answers)… It’s a handy thing to have IMHO

        • just another dev@lemmy.my-box.dev
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          2
          ·
          edit-2
          3 months ago

          If getting a Dropbox account is too difficult for them, I seriously wonder why they’d be subscribed here, or reading articles about password management in browsers.

          • Ilovethebomb@lemm.ee
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 months ago

            Because I’m interested in tech news, especially since the world we live in can’t function without it.

            Besides, Lemmy seems to seriously overestimate the technical abilities of, well, most people.

    • suction@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      3 months ago

      Never trust your credentials to a private company, they could be bought out by state actors.

      • Katana314@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        3 months ago

        Never trust your credentials to yourself, you can be bought out by beer, poor decisions, and tripping over the cables connected to your home server you cobbled together.

      • CosmicGiraffe@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        3 months ago

        The xz compromise having demonstrated that FOSS projects are totally immune to interference from state actors…

  • ZarkleFarkle@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    141
    arrow-down
    7
    ·
    3 months ago

    I put all my passwords in a text document, then print it on a little strip of paper and shove it up my ass. Whenever I take a crap, I dig it out from the turds and try to memorise some of them again. Then I shove it back up there where noone else can find my data and I won’t lose it.

  • daddy32@lemmy.world
    link
    fedilink
    English
    arrow-up
    79
    arrow-down
    1
    ·
    3 months ago

    “Chrome users” or “Chrome under windows users” would be closer to the truth. Still, quite a screw up.

    • DreamButt@lemmy.world
      link
      fedilink
      English
      arrow-up
      14
      arrow-down
      2
      ·
      3 months ago

      Something like 2/3rds of the world uses chrome for desktop. I’d bet that number is higher for windows specifically. If you’re the rare person who doesn’t use chrome then you’re savy enough to know this doesn’t apply to you

  • rekabis@lemmy.ca
    link
    fedilink
    English
    arrow-up
    56
    arrow-down
    3
    ·
    3 months ago

    No-one should be using any password manager built into any browser, neither Chromium-based nor Firefox-based. Browser password databases are almost trivially easy for malware to harvest.

    Go with something external, BitWarden or 1Password, or if you are entirely within the Apple ecosystem their new password system built into iOS 18 is apparently really good.

    • dan@upvote.au
      link
      fedilink
      English
      arrow-up
      24
      ·
      edit-2
      3 months ago

      Go with something external, BitWarden or 1Password,

      When it comes to security software, I usually recommend sticking to open-source solutions, which is why I’d recommend Bitwarden over 1Password. Their whole stack (backend, frontend, and native apps) is all open-source. A premium account is well worth the $10/year.

      You can self-host their server, or self-host Vaultwarden which is an unofficial API-compatible reimplementation of the Bitwarden backend designed to be lighter weight. Note that Vaultwarden is unofficial and hasn’t gone through the same security audits as Bitwarden has. It’s a good piece of software though.

      • rekabis@lemmy.ca
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        1
        ·
        3 months ago

        Use ButWarden myself for a login-only subset of my KeePass content. I absolutely recommend it every chance I get, but some people prefer 1Password because reasons. And 1Password is pretty much the best closed-source option out there, which is why I do so… anything to give people options that keep them away from clusterf**ks like LastPass.

        • JC1@lemmy.ca
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          I migrated from Bitwarden to 1password because I wanted something that works better on Linux. With 1password-cli and PAM integration mainly. Bitwarden worked beautifully under Windows, but once I switched over to Linux, I realised that 1password had more Linux friendly features. I track some discussions over bitwarden that talk about implementing those features, I might come back at some point.

        • dan@upvote.au
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          3 months ago

          Definitely true… Using 1Password is still better than reusing the same password for every site. I’ve never used it but it gets a lot of good feedback, especially from Mac users.

          • JackbyDev@programming.dev
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            3 months ago

            The only problems I’ve had with 1password are usually not 1password’s fault. Like needing to log into something that opened through the Gmail’s app’s built in browser that closed the page when the app loses focus.

            I wish there was a way to link passwords and have note fields that are hidden by default. I’ve got a lot of stuff at work that is linked to my LDAP password but for various reasons uses different usernames on different sites. It’d be nice if there was a way to tell it “I know this password is reused, I promise it’s okay”

      • JackbyDev@programming.dev
        link
        fedilink
        English
        arrow-up
        5
        ·
        3 months ago

        That’s what I used before 1password. The UI is a bit finicky but it works great. Plus you can shove it into DropBox or other various cloud sync things to get a “cloud” version lol.

      • rekabis@lemmy.ca
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        I have that as an offline DB. Holds 100% of all creds that can go offline (no 2FA, unfortunately) and a bunch of extra stuff that most other managers aren’t flexible enough to do.

    • howrar@lemmy.ca
      link
      fedilink
      English
      arrow-up
      3
      ·
      3 months ago

      What makes the built-in database easier to attack than a separate one?

      • rekabis@lemmy.ca
        link
        fedilink
        English
        arrow-up
        3
        ·
        edit-2
        3 months ago

        What makes the built-in database easier to attack than a separate one?

        For performance reasons, early versions weren’t even encrypted, and later versions were encrypted with easily-cracked encryption. Most malware broke the encryption on the password DB using the user’s own hardware resources before it was even uploaded to the mothership. And not everyone has skookum GPUs, so that bit was particularly damning.

        Plus, the built-in password managers operated within the context of the browser to do things like auto-fill, which meant only the browser needed to be compromised in order to expose the password DB.

        Modern password managers like BitWarden can be configured with truly crazy levels of encryption, such that it would be very difficult for even nation-states to break into a backed-up or offline vault.

      • Telorand@reddthat.com
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        3 months ago

        It’s protected by the user’s login password. If an attacker can steal that or knows it already, the passwords are all there for them to see.

        Bitwarden (on the other hand, for example) has 2FA options to unlock the database.

        • howrar@lemmy.ca
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          Oh, so you mean local vs external, not browser-based vs other local solutions.

        • orbitalmayo@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          How does this work if accessing Bitwarden via the browser extension? I don’t like needing to type my master password in all the time as it’s long, so I have the setting turned on that times the vault out periodically, but so it’s also unlockable with a pin rather than requiring the master password every time. I understand the pin is shorter, but does the protection of the vault still stand?

          • Telorand@reddthat.com
            link
            fedilink
            English
            arrow-up
            2
            ·
            3 months ago

            That’s a good question. I don’t actually know the answer to that. I know the passwords are hashed locally when your vault is locked and before being synced, but I’m not sure whether it’s in plaintext when it’s unlocked or if it uses some kind of on-demand decryption. It’s probably in their docs, I should think.

    • dan1101@lemm.ee
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      7
      ·
      3 months ago

      All of them are vulnerable to bugs though. Just a matter of luck.

        • dorythefish@discuss.online
          link
          fedilink
          English
          arrow-up
          7
          ·
          3 months ago

          One of the mobile clients corrupted all passwords for me. I ended up losing only 2 passwords, and only 1 I wasn’t able to restore. Good lesson on why backups are important though :)

          • PrettyFlyForAFatGuy@feddit.uk
            link
            fedilink
            English
            arrow-up
            3
            ·
            3 months ago

            One of the reasons i use Mega to sync my keepass db across devices where it’s needed. They have version control, so if it gets corrupted then i can restore from a previous version

        • Feathercrown@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          2
          ·
          3 months ago

          If he knew, do you think he’d be wasting time talking here about it instead of, I don’t know, ransoming millions of user passwords?

          • communism@lemmy.ml
            link
            fedilink
            English
            arrow-up
            5
            ·
            3 months ago

            I like to think that most people would just contact the devs privately to get a fix pushed asap instead of ransoming everyone’s passwords.

            • Feathercrown@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              1
              ·
              3 months ago

              Right, but my point was that there aren’t public bugs in encryption algorithms just hanging around. Asking for those is categorically bad faith.

  • krimson@lemmy.world
    link
    fedilink
    English
    arrow-up
    44
    ·
    3 months ago

    Recently started using Bitwarden and it works really well. You can even ditch authenticator because it has OTP built in too.

    I selfhost it though because I trust nobody with this type of sensitive data, encrypted or not.

      • EddoWagt@feddit.nl
        link
        fedilink
        English
        arrow-up
        19
        arrow-down
        2
        ·
        3 months ago

        Not really as you’re still protected from password breaches, which is most likely to happen anyways, especially if you self host.

        If you’re actively being targeted for your bitwarden password, you likely have bigger problems

      • paholg@lemm.ee
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        2
        ·
        3 months ago

        Not if you use 2 factor to access the password manager.

          • Godnroc@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            arrow-down
            1
            ·
            3 months ago

            To set a scene, you awake in the middle of the night because your phone is making noise. Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep. The intruder now has access to your password manager!

            They attempt to log into your bank and drain your life savings, but despite having your password it sends another prompt to your phone. This time, you wake up enough to realize something is wrong. This time, you deny the prompt.

            The entire second paragraph cannot happen if your MFA is a single factor. Don’t store MFA in your password manager!

            • Hexarei@programming.dev
              link
              fedilink
              English
              arrow-up
              5
              ·
              3 months ago

              If your MFA is stored in your password manager, you’re not getting prompts to your phone about it. You’re just prompted for a otp code that you have to go out of your way to copy/paste or type in from the manager.

            • subtext@lemmy.world
              link
              fedilink
              English
              arrow-up
              4
              ·
              3 months ago

              I mean yeah it’s less secure than if they were separated. But my mom is never going to use a separate app for passwords and 2FA, so the two in one app is still better than nothing.

            • JackbyDev@programming.dev
              link
              fedilink
              English
              arrow-up
              3
              ·
              3 months ago

              Blearily you unlock it, glance at a prompt, and then approve a login and fall back asleep.

              The idea that people would approve that is wild to me.

              • Godnroc@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                3 months ago

                Mate, I’ve had users who were sharing an account that only some of them had MFA prompts for. They didn’t bother checking who had initiated the prompt, they just approved it because it was easier. And that was while they were fully awake and thinking…

                • JackbyDev@programming.dev
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  3 months ago

                  What’s funny to me is that doing this while you know your target is asleep probably has a higher success rate just because they’re more likely to press the wrong thing just because their eyes are groggy. I can read my phone without my glasses but when I wake up in the night that’s not the case right away.

            • Telorand@reddthat.com
              link
              fedilink
              English
              arrow-up
              2
              ·
              3 months ago

              Bruh, if my phone is sending me notifications in the middle of the night, the first thing I’m doing is uninstalling whatever app is sending me notifications.

              If people are that gullible to fall prey to an attack like this, managing OTP in two apps is probably more than they can handle anyway. Everybody has a different threat model, and it’s okay if it’s not covered by hardware passkeys and locally hashed and managed databases.

      • krimson@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        3 months ago

        Technically yes if my vault gets compromised I would be fucked. I have it firewalled tho and only accessible from home (or VPN to home). So should be pretty secure. I used google authenticator but found it a major pita (can’t even search entries on Android, wtf?). If they make this more user friendly I’ll gladly switch back to a seperate OTP store.

    • WarlordSdocy@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      ·
      3 months ago

      I was thinking about self hosting but I was worried it would be less secure. I don’t really know a lot about setting that kind of thing up (I do have programming experience but don’t have a lot of server hosting experience outside of doing it for games like Minecraft) and I feel like I’d mess it up and it would be a lot easier to get into than a hardened server. Especially cause the odds I get a virus or something is probably higher then the odds someone breaks into bitwarden’s server. Idk if I’m wrong about this, would love to be corrected if I am, was just my initial thoughts when I switched over from a different password manager to bitwarden.

      • subtext@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        3 months ago

        If you don’t trust yourself 110%, don’t host it yourself. Too risky. I self-host everything, but I leave email and passwords to someone else because it’s just too important.

      • SkyeStarfall@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        2
        ·
        3 months ago

        I think the bigger thing to worry about is, what would happen if your server fails or is destroyed? Would you have a backup of all your passwords? And if yes, are those backups updated regularly and stored in a safe place that also won’t get destroyed if the server gets destroyed (like, say, a house fire)?

        Then, yes, you got the cybersecurity angle too

        It’s a lot to think about for something as important and fundamental to everything you do on the internet as passwords (and accounts)

        • Avero@feddit.org
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 months ago

          backups aren’t that big of a deal with bitwarden as every client keeps a copy of the database that can be restored.

      • krimson@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        3 months ago

        It’s pretty easy to setup using docker, you do need to know that ofcourse and how to setup dns and stuff.

        I have it firewalled so my vault is not accessible from the internet, only from home or vpn to home.

    • YTG123@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      3 months ago

      And it can also store passkeys to effortlessly sync between desktop/Android/iOS

    • yggstyle@lemmy.world
      link
      fedilink
      English
      arrow-up
      44
      ·
      3 months ago

      A better statement should be: you should remain vigilant and light on attachment to any banner. If an ill wind blows and you don’t like it, it’s time to move. Control your data- aspire to be a digital nomad.

      Firefox isn’t without it’s own issues, recently. Google used to be viewed as a paragon once, too.

    • BearOfaTime@lemm.ee
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      32
      ·
      3 months ago

      I don’t use the password manager in Firefox, what a terrible idea.

      Use an independent password manager, something purpose-built.

      And using Linux? Hahaha, right, right. Call me when there’s a serious OneNote, or even more importantly, Excel competitor. (Or even a standard shell on Linux, or the same set of tools built in).

      • ᗪᗩᗰᑎ@lemmy.ml
        link
        fedilink
        English
        arrow-up
        16
        arrow-down
        1
        ·
        3 months ago

        Call me when there’s a serious OneNote…

        OneNote works on the web, but there’s also Notenook if someone is looking for similar features with an app for offline access + End-to-end encryption and open source alternative. I’ve got it syncing to my Android, Windows, Linux and Mac clients without issue.

        …or even more importantly, Excel competitor.

        There’s OnlyOffice which has a spreadsheet. Yeah it’s not Excel which has existed for a million years, but it should work for the vast majority of users’ basic needs. It may not work for your specific use case, but it is a viable alternative that exists today. If you want more online collaborative features (like the o365 version has) you can use CryptPad, which provides an end-to-end encrypted and open-source collaboration suite, including the web version of OnlyOffice Spreadsheets.

        Or even a standard shell on Linux…

        What does this even mean? Nearly every major Linux distro sets bash as the default shell, and if not the default, is probably already installed and called if needed. Not sure I understand the problem here.

        …or the same set of tools built in

        Stick to a single OS and you get the same set of tools built in? This is a strange statement to be making against a system that not only thrives on diversity but has lots of niche systems that require a myriad of default tools.


        I do completely agree about not using any browser’s built-in password manager.

      • I agree that using browser-based password managers is not a good idea, but everything else you said was willfully ignorant.

        • OneNote isn’t that special, and you don’t need Windows to use it.
        • There are half a dozen excel competitors that are feature complete (OpenOffice, LibreOffice, GSuite, Zoho, Gnumeric…)
        • All shells use the same standard tools, excepting a few bulit-ins (because most tools are external to the shell). Some shells have different syntax, but most of them share most syntax. In 90% of cases, the default shell is bash, or an offshoot (dash, etc), which are all descendants of sh, so unless you’re using an extended feature set, scripts are cross-compatible.
      • lemmyvore@feddit.nl
        link
        fedilink
        English
        arrow-up
        4
        ·
        3 months ago

        Firefox Sync was purposefully built too, they didn’t wake up one day to find it on the porch in a basket.

        It syncs passwords, works on desktop and mobile and can do some other cool stuff — syncs tabs and bookmarks, alerts you to password breaches, send tabs from one device to another, lets you export your passwords etc. It’s a good password manager.

      • tabular@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        edit-2
        3 months ago

        It is not the software which can lack seriousness, but the developer and the user. One is proprietary where the developer controls the user’s computing - the other is free software where the user is in control (free as in freedom).

      • Aatube@kbin.melroy.org
        link
        fedilink
        arrow-up
        6
        arrow-down
        7
        ·
        edit-2
        3 months ago

        Use an independent password manager, something purpose-built.

        Why? You’re talking as if browser password managers aren’t purpose-built. “I love entering a password to fill my passwords for me instead of entering a password” —statement dreamed up by the utterly deranged. (I think we all should just use auto-locking.)

        OneNote

        Web-based stuff like Notion and Google Keep

        Excel

        LibreOffice Calc with Tabbed UI

        standard shell

        what is that

  • MrsDoyle@lemmy.world
    link
    fedilink
    English
    arrow-up
    30
    arrow-down
    6
    ·
    3 months ago

    A friend has a notebook next to her computer with all her passwords in it. Initially I was horrified - what if you’re burgled? - but actually it’s genius. Much more secure than letting a browser remember them, and she doesn’t even need to memorise a Bitwarden password.

  • Chaotic Entropy@feddit.uk
    link
    fedilink
    English
    arrow-up
    24
    arrow-down
    2
    ·
    3 months ago

    Premium Bitwarden is so cheap and effective that I find it difficult to justify using an alternative.

    • communism@lemmy.ml
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      1
      ·
      edit-2
      3 months ago

      Keepass with syncthing is completely free and doesn’t rely on cloud hosting

      • ikidd@lemmy.world
        link
        fedilink
        English
        arrow-up
        9
        ·
        3 months ago

        Not a bad idea to back up to a json, but every computer you’ve used has a local encrypted copy you can export from using the app or extension.

    • Gregor@gregtech.eu
      link
      fedilink
      English
      arrow-up
      2
      ·
      3 months ago

      I self host my own Vaultwarden instance (a bitwarden server written in Rust) and it’s more reliable than Google’s password manager.

    • boyi@lemmy.sdf.org
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 months ago

      I use encfs and sync it to dropbox etc. Then use gopass password manager to store password in the encfs folders. Not fully auto-integrated but good enough for me.