Google was always incorrectly viewed as a paragon.

Use an independent password manager, something purpose-built.

Why? You're talking as if browser password managers aren't purpose-built. "I love entering a password to fill my passwords for me instead of entering a password" —statement dreamed up by the utterly deranged. (I think we all should just use auto-locking.)

OneNote

Web-based stuff like Notion and Google Keep

Excel

LibreOffice Calc with Tabbed UI

standard shell

what is that

Call me when there’s a serious OneNote…

OneNote works on the web, but there’s also Notenook if someone is looking for similar features with an app for offline access + End-to-end encryption and open source alternative. I’ve got it syncing to my Android, Windows, Linux and Mac clients without issue.

…or even more importantly, Excel competitor.

There’s OnlyOffice which has a spreadsheet. Yeah it’s not Excel which has existed for a million years, but it should work for the vast majority of users’ basic needs. It may not work for your specific use case, but it is a viable alternative that exists today. If you want more online collaborative features (like the o365 version has) you can use CryptPad, which provides an end-to-end encrypted and open-source collaboration suite, including the web version of OnlyOffice Spreadsheets.

Or even a standard shell on Linux…

What does this even mean? Nearly every major Linux distro sets bash as the default shell, and if not the default, is probably already installed and called if needed. Not sure I understand the problem here.

…or the same set of tools built in

Stick to a single OS and you get the same set of tools built in? This is a strange statement to be making against a system that not only thrives on diversity but has lots of niche systems that require a myriad of default tools.

I do completely agree about not using any browser’s built-in password manager.

It is not the software which can lack seriousness, but the developer and the user. One is proprietary where the developer controls the user’s computing - the other is free software where the user is in control (free as in freedom).

I agree that using browser-based password managers is not a good idea, but everything else you said was willfully ignorant.

• OneNote isn't that special, and you don't need Windows to use it.
• There are half a dozen excel competitors that are feature complete (OpenOffice, LibreOffice, GSuite, Zoho, Gnumeric...)
• All shells use the same standard tools, excepting a few bulit-ins (because most tools are external to the shell). Some shells have different syntax, but most of them share most syntax. In 90% of cases, the default shell is bash, or an offshoot (dash, etc), which are all descendants of sh, so unless you're using an extended feature set, scripts are cross-compatible.

Firefox Sync was purposefully built too, they didn’t wake up one day to find it on the porch in a basket.

It syncs passwords, works on desktop and mobile and can do some other cool stuff — syncs tabs and bookmarks, alerts you to password breaches, send tabs from one device to another, lets you export your passwords etc. It’s a good password manager.

Funny troll is funny

Say there’s no standard shell on Linux again and I’ll Bash your head in

.

Exactly! Self hosted FTW. Chances of a data breach… Typically pretty minor if you are smart.

+1 for a self-hosted Vaultwarden instance. If you’re technically capable and have extra hardware laying around this is the best way to go.

Most amazingly, this setup is also unexpectedly resilient against merge conflicts and can sync even when two copies have changed. You wouldn’t expect that from tools relying on 3rd party file syncing.

I still try to avoid it, but every time it accidentally happened, I could just merge the changes automatically without losing data.

I store my DB in Dropbox and use KeePass2Android on phone which has built in Dropbox sync.

Typically, the drawer just below the keyboard (in my experience)

If you never, ever need your passwords outside of your home, that’s great advice - it’s as secure as can be against digital theft. Less so against fire though, and backups are out of the question.

This is the first suggestion here that’s actually within the technical abilities of most people, even most Lemmy users.

The level of technical knowledge some of people here seem to think the general public has is absurd.

I’m not sure what you’re comparing it to. Keepass is free too, in fact it’s open source. In my opinion, local software and database that is under your control is always superior to cloud.

Keepass over Bitwarden offers a lot of plugins and integrations, again, if you want more customization or automation.

But, I would say you can use any online password manager as long as it’s end to end encrypted, so Bitwarden is a good choice.

The xz compromise having demonstrated that FOSS projects are totally immune to interference from state actors…

Never trust your credentials to yourself, you can be bought out by beer, poor decisions, and tripping over the cables connected to your home server you cobbled together.

Which bugs breaks Keepass encryption?

Following up your own shit post with another shit post is shit post gold.

Spectacular

I’m scared of downloading after that Mexican party

Maybe, but it would have to be personal and in my ass if I had or ever did.

Sounds like a security risk.

The server side literally doesn’t matter. Even if it is FOSS they could do anything they please with it, other than reading it, because it’s all encrypted. They could wipe all passwords if they so wanted.

Well sure… I have a local offline encrypted copy, rather than a whole separate password manager.

Not a bad idea to back up to a json, but every computer you’ve used has a local encrypted copy you can export from using the app or extension.

*********** that’s what I see

Yeah, these newfangled password requirements ruined my life. I refuse to sign up for any website that doesn’t let me use hunter2.

Ah, my girlfriend’s approach. No matter how much I show her a pwned password or set her up on my Vaultwarden, she’s not interested

Assuming the laptop is running bitlocker (often on by default), has a user password, and is offline, that’s pretty decent.

Kind of like salting.

That’s an excellent idea! I’ll mention it to her.

Where is this book? In the office? I’d say that’s absolutely horrible. If it’s at home I think that’s more okay.

Modern problems require modern solutions

Not if you use 2 factor to access the password manager.

Not really as you’re still protected from password breaches, which is most likely to happen anyways, especially if you self host.

If you’re actively being targeted for your bitwarden password, you likely have bigger problems

Technically yes if my vault gets compromised I would be fucked. I have it firewalled tho and only accessible from home (or VPN to home). So should be pretty secure. I used google authenticator but found it a major pita (can’t even search entries on Android, wtf?). If they make this more user friendly I’ll gladly switch back to a seperate OTP store.

It’s pretty easy to setup using docker, you do need to know that ofcourse and how to setup dns and stuff.

I have it firewalled so my vault is not accessible from the internet, only from home or vpn to home.

If you don’t trust yourself 110%, don’t host it yourself. Too risky. I self-host everything, but I leave email and passwords to someone else because it’s just too important.

I think the bigger thing to worry about is, what would happen if your server fails or is destroyed? Would you have a backup of all your passwords? And if yes, are those backups updated regularly and stored in a safe place that also won’t get destroyed if the server gets destroyed (like, say, a house fire)?

Then, yes, you got the cybersecurity angle too

It’s a lot to think about for something as important and fundamental to everything you do on the internet as passwords (and accounts)

Yep, and Vaultwarden too!

Though the most secure practice is to store them separately.

It is a paid feature though if you don’t selfhost

So does keepass

Yep, for only $10 per year. But just make sure to keep backups of your vault and/or make an emergency kit.

I have that as an offline DB. Holds 100% of all creds that can go offline (no 2FA, unfortunately) and a bunch of extra stuff that most other managers aren’t flexible enough to do.

That’s what I used before 1password. The UI is a bit finicky but it works great. Plus you can shove it into DropBox or other various cloud sync things to get a “cloud” version lol.

It’s protected by the user’s login password. If an attacker can steal that or knows it already, the passwords are all there for them to see.

Bitwarden (on the other hand, for example) has 2FA options to unlock the database.

What makes the built-in database easier to attack than a separate one?

For performance reasons, early versions weren’t even encrypted, and later versions were encrypted with easily-cracked encryption. Most malware broke the encryption on the password DB using the user’s own hardware resources before it was even uploaded to the mothership. And not everyone has skookum GPUs, so that bit was particularly damning.

Plus, the built-in password managers operated within the context of the browser to do things like auto-fill, which meant only the browser needed to be compromised in order to expose the password DB.

Modern password managers like BitWarden can be configured with truly crazy levels of encryption, such that it would be very difficult for even nation-states to break into a backed-up or offline vault.

Use ButWarden myself for a login-only subset of my KeePass content. I absolutely recommend it every chance I get, but some people prefer 1Password because reasons. And 1Password is pretty much the best closed-source option out there, which is why I do so… anything to give people options that keep them away from clusterf**ks like LastPass.