It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can’t remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.

Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don’t just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They’re not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser’s password storage is better than nothing. Don’t reuse passwords, use long randomly generated ones.

It’s free, it’s convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I’m preaching to the choir, but if even one of you decides to use a password manager after this then it’s an easy win.

Please, don’t wait. If you aren’t using a password manager right now, take a few minutes. You’ll thank yourself later.

    • Dyskolos@lemmy.zip
      81·
      4 months ago

      With keepasscx YOU have the password-file. Period. You know what’s been done with it: Nothing, as it doesn’t phone home except update-checks. Which you can also disable.

      With the browser-addon you’ll get the same result but with control.

    • rowdy@lemmy.worldEnglish
      5·
      4 months ago

      Bitwarden exploit was already patched. And required a domain joined PC with Windows Hello active, and the attackers already had access to the DC. Not exactly a large vector. Also enterprise PCs shouldn’t be using windows hello to begin with, IMO. Now if we look at CVEs affecting browser password managers, there are literally exploits for download on GitHub.

    • The Cuuuuube@beehaw.orgEnglish
      3·
      4 months ago

      In-built password managers for browsers are straightforward to crack. Like… Terrifyingly easy. It’s much better to use something like Bitwarden, Vaultwarden if you don’t trust Bitwarden, 1Password if you really want the reassurance of paying someone for trust, or KeePass if you don’t trust anyone at all (I, personally, fit into this category).

      • zeh_ahoiEnglish
        1·
        4 months ago

        show me an example of the firefox password manager being “cracked”. i mean i still sync them into my local nextcloud. @Dyskolos@lemmy.zip suggests it is cool to have your passwords in a file?!

        doubt there is a scenario where using MORE services makes anything safer. Well maybe for Windows Users…but thats a dying species with the win11 crap.

        so no. third party corpos…the worst.

        • The Cuuuuube@beehaw.orgEnglish
          1·
          4 months ago

          Sure yeah. I think corpos suck, too. That’s why I don’t prefer 1password. But Firefox puts their passwords into a file, too (two actually). Key3.db and Logins.json, both with known locations, and encrypted using AES-256-GCM which is… Decent but I prefer to go a little more hardened. The thing with keepass is the following:

          1. Its open source, no corpo
          2. The file encryption you select can be as hardened as you want
          3. No one but you need know the location of your file
          4. It offers 2fa which Firefox password manager doesn’t
          5. Firefox password manager is more susceptible to social engineering attacks is mainly what I was worried about but it seems like you’ve got a good handle on it.
          6. You don’t have to integrate keepass with the browser to use it

          But I want to make it abundantly clear. @Dyskolos@lemmy.zip has not recommended storing your passwords in a file. They have suggested storing your passwords in a mechanism that can be as secure as your hardware is capable of securing and keeping the location of that up to your own decision making.

          But also. Promise me this. If you’re going to keep using Firefox as your password manager:

          1. Don’t use sync. That’s run by Firefox’s corporate arm, Mozilla PBC
          2. Use a primary password of at least 32 characters
          3. Consider rotating your password on a regular interval, like on your birthday
        • Dyskolos@lemmy.zip
          1·
          4 months ago

          I dunno where you got that shit, but i never suggested to use a file or whatever. I’m keepassxc-user.