password manager questions

[veltix]

Anyone uses password manager? Has your password manager been hack? Is it safe to use?


Read HWZ Forum Rules!

 

[yusoffb01]

Anyone uses password manager? Has your password manager been hack? Is it safe to use?


Read HWZ Forum Rules!

 

[firesong]

Anyone uses password manager? Has your password manager been hack? Is it safe to use?


Read HWZ Forum Rules!

I use and self-host Bitwarden (using vaultwarden) for my family. Pretty good. Works across platforms, which was a main goal - Windows, macOS, Linux, iOS, Android.

Backups of the password DB are done via rclone to my NAS. Have tested a restore a few times, and it works flawlessly. If the box goes down, just set up another, place the password DB files in the Docker data directory for vaultwarden, and rebuild the docker container.

It did require I have my own domain name as I wanted to use FIDO2 2FA. Dynamic DNS resolvers help solve the DHCP issue, although you could opt for ISPs with static IP services (M1, MyRepublic, Viewquest).

 

[Hafi]

Tip Number 1: never use the password manager that browsers built-in provide
Tip Number 2: don't sync and store your password database (file) to the cloud or the password manager's own vault (cloud)
Tip Number 3: always save and backup password database locally and maintain backup copies (use a PM which is capable of saving/retrieving DB from a offsite LAN like NAS, router USB)

 

[firesong]

Tip Number 1: never use the password manager that browsers built-in provide

Chrome, Firefox, Edge no.
Apple's isn't stored in the browser but their Keychain (you can review the entries on a Mac) so it's OS-level security, a little bit more secure and works well, but I prefer something platform agnostic. For those who only use Macs and iPhone/iPad, it's perfectly adequate imo.

Tip Number 2: don't sync and store your password database (file) to the cloud or the password manager's own vault (cloud)
Tip Number 3: always save and backup password database locally and maintain backup copies (use a PM which is capable of saving/retrieving DB from a offsite LAN like NAS, router USB)

Very good tips here. I had the same thought process. However, I feel it really depends on whether a person is able to secure their own vaults, and whether they have a backup system in place. Even before that, it assumes the person has the knowledge and inclination to set up his own vault hosting mechanism!

I was extremely conscious that if my own private server went down, my entire family's passwords would be lost - that's a very difficult position to be in, especially when I have finally made them generate a random password for each of their logins - only having to remember their Password Manager's account password. Most of the time they only need to use their fingerprint to get in, but it's a mess when they change phones or have to relogin, because my parents can't remember their DB password. Thankfully, they have written it down at home and store it securely - it does not leave the house, so I am fairly okay with it. I have told them never to share it with anyone outside of the family.

Also, I would suggest to people who self-host that they learn how to restore from their password db backups. Take down the server intentionally, copy their latest DB backup in and set it up accordingly - to ensure it works. Document the process as necessarily. I think Keepass has an edge here since it's the db file itself that's shared across clients, and does not require a separate app to manage it unlike Vaultwarden. Despite that, I think VW is pretty good for home and even SOHO use.


Now, the real caveat is that setting up all these servers requires a little bit more tech expertise (or at least, a willingness to learn and waste some time), so it's not accessible to everyone. There are advantages to paying for a password provider to host your password solution. If users prefer to use an online host, ensure that their storage systems are secure and their security track record is top-notch. It'll cost a lot more in the long run compared to grabbing a cheap Raspberry Pi and running your own server at home, but the biggest advantage is that you are not saddled with maintenance, hardware failure, and troubleshooting frustrations which are intangible costs.

PS: It depends on your cloud backup mechanism of choice. Some use B2 providers like Amazon S3 or Backblaze to back their NASes up to the cloud. I personally feel Google's servers are adequate for an rclone mirror of your password DB for additional redundancy, but you must secure that account tightly, and perhaps not use obvious names so it's just a random file.

 

[stupidog]

i using 1password

 

[Valien]

Anyone uses password manager? Has your password manager been hack? Is it safe to use?


Read HWZ Forum Rules!

I'm using Keepass2Android in all my Android smartphones.

Bitwaren is another great app which I'm still testing after two years with some passwords added, but I'm just lazy to migrate all my hundreds of password from Keepass to Bitwaren.

 

[firesong]

I'm using Keepass2Android in all my Android smartphones.

Bitwaren is another great app which I'm still testing after two years with some passwords added, but I'm just lazy to migrate all my hundreds of password from Keepass to Bitwaren.

Migration can be quite messy. I migrated from 1password to Lastpass to Bitwarden, and each time something changes - cos they all use slightly different fields. The export/import is the easy part. Cleaning up takes a bit of time.
https://trycatch.dev/blog/switching-from-keepass-to-bitwarden-after-14-years/