cross-posted from: https://infosec.pub/post/42164102
Researchers demo weaknesses affecting some of the most popular options Academics say they found a series of flaws affecting three popular password managers, all of which claim to protect user credentials in the event that their servers are compromised.…
25 Comments
FriendOfDeSoto@startrek.website · 53 pts · 183d
I appreciate the air of publicity this story brings.
In other headlines: water is surprisingly wet.
nuko147@lemmy.world · 9 pts · 183d
Yeah, the title is not that informative.
hexagonwin@lemmy.today · 26 pts · 183d
KeePassXC ftw
url@feddit.fr · 19 pts · 183d
I always keep my keepass databases offline for good
thermal_shock@lemmy.world · 6 pts · 183d
Bitwarden offers offline also. And self hosting I believe.
dessalines@lemmy.ml · 2 pts · 182d
IMO Its fine to sync them with syncthing, as that's end to end encrypted.
url@feddit.fr · 2 pts · 181d
The vault is also encrypted so you are fine
nuko147@lemmy.world · 2 pts · 183d
I need to search this KeePass. I read it in other comments, but I have never heard of it before.
detonational_VuSE@lemmy.ml · 5 pts · 183d
It's pretty good. I was using pass but keypassxc is easier. It also handles passkeys well. Here it is on Windows: https://portableapps.com/apps/utilities/keepassxc-portable. For Linux, just search for it in the package manager. Not sure about Mac.
Scrollone@feddit.it · 6 pts · 183d
KeepassXC is also available for Mac.
FineCoatMummy@sh.itjust.works · 4 pts · 183d
KeyPassXC is the way to go, IMO. It is wonderful. The password db is stored locally on your disk. It integrates nicely with firefox and probably other browsers too. Open source, no spyware, "just works".
deadmyk@lemmy.world · 7 pts · 183d
In other news. Water is wet
TyrionBean@lemmy.ml · 1 pts · 181d
I use Pass since a few years. It has a wonderful package for Emacs, and great iOS apps with face ID for ease of use, and the DB can sync to your own private git server behind tailscale. If you have a server, I definitely suggest looking into it. You can check it out at https://www.passwordstore.org/
ScoffingLizard@lemmy.dbzer0.com · 0 pts · 183d
Am I the only person here that never used one just because of this? They all sounded too sus to me.
muhyb@programming.dev · 15 pts · 183d
You can use local ones like KeePassXC.
ScoffingLizard@lemmy.dbzer0.com · 2 pts · 183d
I have a degoogled phone with e/OS. I might try if they get a bit further into my use of their products and security. It sure would simplify methods.
muhyb@programming.dev · 1 pts · 182d
I have a similar setup with LineageOS. I use KeePassXC on PC (KeePassDX on Android). I can sync them via Nextcloud with peace in mind because the database is already encrypted. Syncthing-fork also works if you want completely local.
I'm sure e/OS already has a password vault app in their list but if not KeePassXC is fully local out of the box and can be used with DX on Android.
It's far secure than Firefox's built-in password manager.
ScoffingLizard@lemmy.dbzer0.com · 1 pts · 182d
I've only been using e/OS for a few months. Once I gain more confidence in the OS I can certainly try. I'm still super paranoid. It's a lineage fork so there is update lag and possible security limitations in the OS itself. I'm just not sure yet.
autonomoususer@lemmy.world · 7 pts · 183d
Keeping them in your head? So, your passwords must be shit, lmao.
Zero threat prioritisation.
Tenderizer78@lemmy.ml · 11 pts · 183d
correct horse battery staple
ScoffingLizard@lemmy.dbzer0.com · 1 pts · 182d
So checkmustanglithium]
ScoffingLizard@lemmy.dbzer0.com · 0 pts · 183d
See explanation below.
autonomoususer@lemmy.world · -1 pts · 182d
Shit passwords confirmed
ToTheGraveMyLove@sh.itjust.works · 4 pts · 183d
What did you do instead?
ScoffingLizard@lemmy.dbzer0.com · 1 pts · 183d
I have a few that I just have off the wall for a few things and I memorize those. Some I just use ssh keys. Others go off a pattern and I put hints in a file to figure it out. The account itself is not even put in this file, so I have to just know what the hints mean for both the account and what password pattern hints go with them. Usually, the user IDs are something I store in this file, because those get too tough for the aforementioned methods of determinism.