Your go to Password Manager for 2019?

SplitIce

@eastonch I trust LastPass currently so advocating for a second layer of encryption is probably two faced...

eastonch

SplitIce said: @eastonch I trust LastPass currently so advocating for a second layer of encryption is probably two faced...

I learned over Christmas, when I was on a new device, with no access to any of my own personal devices, where my single point of failure exists, as such, I need some redundancy. I'd somehow managed to get myself in a position where I didnt have an authenticated session to my e-mails, didnt have my backup codes for lastpass, didn't have a 2FA device that was hooked to LastPass and I needed to access my e-mails. In hindsight, I could have quite easily downloaded Authy to the device I was using, use the restore function and then gain access again relatively quickly.

Awmusic12635

1password

akhfa

@TimRoo said:

@rsyncs said:
bitwarden (selfhosted), because:

• selfhosted and open-source, you own your data
• dozens of really good applications, e.g. mobile apps, desktop apps, web app and dmenu integration
• nice usability on all platforms

There's also bitwarden_rs which may use way less resources. Both are easily setup using docker-compose.

Exactly what I use. I have it in Docker accessible only on my lan. Works in read-only mode when I’m away from home, which is good enough for me.

What do you mean by read-only mode in bitwarden?

@solaire said:

eastonch said: Can you have multiple "bitwardens" that sync between each other incase of a failure / my LowEndBox deadpools etc / can it be optionally synced with Cloud for redundancy?

Sure. Simply rsync the folder you mount on your Bitwarden Docker container, store it in S3-like storage, or use Kubernetes.

Are there any tutorial to deploy in kubernetes? AFAIK there is no helm chart too

solaire

akhfa said: Are there any tutorial to deploy in kubernetes? AFAIK there is no helm chart too

Haven't done this myself (as I believe Kubernetes is overkill for my usage), but here you go: https://github.com/cdwv/bitwarden-k8s

TimRoo

@akhfa said:

@TimRoo said:

@rsyncs said:
bitwarden (selfhosted), because:

• selfhosted and open-source, you own your data
• dozens of really good applications, e.g. mobile apps, desktop apps, web app and dmenu integration
• nice usability on all platforms

There's also bitwarden_rs which may use way less resources. Both are easily setup using docker-compose.

Exactly what I use. I have it in Docker accessible only on my lan. Works in read-only mode when I’m away from home, which is good enough for me.

What do you mean by read-only mode in bitwarden?

It’s not anything official, I just can’t access the self-hosted server when I’m away from home, so the Bitwarden mobile app works with the database as of the last sync. If I try to edit, add, or delete any entries, I get an error.

Sure, I could establish a VPN to the NAS on my LAN that the Bitwarden server is run from, but I like that additional level of security, and I’m willing to put up with it being inaccessible.

dfroe

KeePass. Even though it might sound a bit old school. But I do not see any reason why I should tell anybody else my passwords. Doesn't matter how trustworthy the other person might be. My passwords are mine..

BTW, nobody mentioned the xkcd Base System yet?

dtoker

bitwarden = open source and clearly more transparency from the developer despite being run by one man/very small biz.

Just moved mine to it coming from lastpass. Was looking for ways to make keepass work with Chromebook but theres just too many

ehab

@eol said:
brain.sh because security.

i clicked on the link, i felt stuiped afterwards and must say your getting smarter everyday WOW.-

eol

@ehab said:

@eol said:
brain.sh because security.

i clicked on the link, i felt stuiped afterwards and must say your getting smarter everyday WOW.-

LOL.
Thanks.
Nice one.

EDIT:
Maybe.

syntrino

We use Bitwarden Business (Hosted) in house at Syntrino.

Personally I used Lastpass.

Both are very good, but Bitwarden, as mentioned by previous users, can also be self hosted.

SteveMC

Using my memory. When I disappear or get Alzheimer, the world ends.

MGarbis

@SteveMC said:
Using my memory. When I disappear or get Alzheimer, the world ends.

I just can't. I have about 100 username password combinations to remember. (very few have the same password) About 10 years ago there were only ten or max 20 username/password to remember. Digitalisation makes us use more webservices and that's why I gave up and started to use Keepass. No more thinking fancy passwords which can be remembered. Just long number, letter and special character combinations. Those are impossible to remember, but more secure.

Edit:
I'm propably changing to Bitwarden_rs, but I'm still testing and studying it.

vserversite

We use lastpass

Letzien

My NSA watcher. I just type 'lil help pls' and he/she/xe/xir paste my password into the field. It's free and doesn't require I sign up for Google.

TimboJones

FFS, is there going to be a monthly password manager thread from now on?

eol

I am still waiting for the password manager manager.

Gravely

@TimboJones said:
FFS, is there going to be a monthly password manager thread from now on?

Yes.

Billy_C

I was using MSecure for a long time, but it started having a hard time syncing data between devices so it went out the door.

Looking at new solutions myself currently. LastPass seems like it may be a contender due to it's sharing features. I like the idea of yelling "Wife did you reset the DirectTV password?" every time a login stops working.

jar

You know, while obscurity may not be a security policy, it still has value in a well planned personal strategy. Limiting people’s knowledge of your personal attack vectors can buy you time in certain situations.

Letzien

@jar said:
You know, while obscurity may not be a security policy, it still has value in a well planned personal strategy. Limiting people’s knowledge of your personal attack vectors can buy you time in certain situations.

If you don't have a habit of getting completely shitfaced and passing out on a strangers couch while rooted in from your portable Debian keyfob?