Bitcoin Forum

I never used password managers, but I am inclined to use now.

I was reading about them, and find nice reasons to use one.

- Creates good passwords very easily, just clicking a button. If you use the same password on many websites, one of them may be hacked or whatever and the attacks can use the passwords in other websites which you will probably have accounts too.
- Easier to use, just click a button and it is available, you don't have to type.
- stored encrypted in the manager's vault.


Then I was searching about which one to use. I would like a free version, what do you guys recommend?


-LastPass is the one most people talk about. However, I read somewhere it was already hacked in the past...?
-KeePass I read nice things about this one too.
-I read also that Firefox has a built in password manager that can be encrypted with a Master Password.

What do you guys think is better to use? It would be nice if I didn't need to download one more add-on (I try to be minimalist with apps/add-ons).

I personally use Keepass. I personally like their autotype feature to input your user name and password. It defeats keyloggers because it inputs random characters while typing in characters. Unfortunately, some web pages don't work with this feature, so you have to resort to using the copy/paste feature which is less secure. It also has a feature for additional security which requires a Key file. I haven't used it because the keyfile cannot be changed or moved from it's location on the computer. If it becomes corrupted, deleted or moved, you could get locked out of your data base.

I wrote my own password manager in Javascript, it encrypts the password storage with AES-GCM, and uses PBKDF2 for key derivation. I posted it in /r/crypto for review and people said it's ok. Just yesterday I turned it into an Electron app so it can work with files more conveniently, previously it was browser-based and relied on LocalStorage.

I don't recommend to role your own password manager to anyone, just want to say that using one is so much better than no manager at all, or relying on the browser, and nowadays everyone should have a strong a truly random password, especially if they deal with something like crypto.


I always used the browser feature to save passwords, but it lacks one important function from password manager programs - generation of random passwords. Now that I have a full password manager, I'm not worried that I'll have similar passwords on multiple sites, and other accounts will get pwned if some of the sites has a security breach.

My favorite ones are Bitwarden and KeePass.

KeePass if you want to store your passwords locally in a file - no risk of getting hacked - or Bitwarden (over Lastpass) if you don't mind using a third-party server (passwords are encrypted anyway). Both are open source and you can actually self-host your own Bitwarden server, storing everything in one of your servers.

Also, while Bitwarden works perfectly in their free version (no major features missing), you can actually pay for the pro version which is cheaper than any other password manager and have things like 2FA OTP in your entries.

You can also try to visit my thread before, I have included some good password managers there included KeePass and Password Safe.
I included some of the tutorials on how to use them and also advantages/disadvantages of using password managers or creating a strong/secure passwords.

[GUIDE] How to Create a Strong/Secure Password (https://bitcointalk.org/index.php?topic=5132378.0)
Hello everyone, I found another alternative for KeePass Password manager.  (https://bitcointalk.org/index.php?topic=5132378.msg51415058#msg51415058)

Just a piece of advice, try to use open-sourced password managers, avoid those password managers that have a subscription, because for me, no need to pay just for password managers, but it's still your choice if you really need their special feature for the premium password managers.

+1 to both.

Which on of the two? You gotta decide yourself. KeePass can be more secure because your password database will only be stored on your computer, but this sacrifices a bit of the user-friendliness. With Bitwarden, you either let them host your password database, or you host it yourself on your own server. Hence you can more easily access your Bitwarden pwd database on multiple devices; and not to mention that Bitwarden has their own browser extension that has the auto-fill feature so you wouldn't need to manually copy paste every password.

I personally think Bitwarden is the perfect balance between security and usability, but it's up to you.

P.S. Both are open-source. Which is a huge plus in my book.

Not all webpages will recognise password managers that's why I don't use them

You can easily click on the password manager icon and copy the username, paste it, copy the password, paste it. It takes literally 5 seconds.

What if my device get hacked? Is it possible for the hacker to get my password from a password manager by having control of my device? I never felt the necessity of using a password becauss I am using only limited sites.

If you get hacked, he’ll see everything you type. What difference will make if you’re using a password manager or not? Password managers aren’t fool proof.

Password Managers are mostly used by lazy people. Why do you need a third party service to generate and store passwords for some of your most sensitive information? Do you have a 100% guarantee that those services are 100% secure? How will you know if they are not simply gathering data for some government agency?

Yes, the data is encrypted, but governments have access to very powerful equipment to possibly decrypt some of the data stored on these sites or they partner with companies that has knowledge and resources to do this.  ::)

I wonder why nobody mentionned Bruce Schneier's passwordsafe:

https://www.schneier.com/academic/passsafe/

https://pwsafe.org/

HTH

Is there any one with stored pass in a cloud? Is this safe after-all?

I use two computers and mobile. I need something that can be synced once store a password on one device to be available on another.

With proper encryption, it theoretically is relatively safe.

However, this is not recommended at all. You never know who will gain access to the encrypted file.
And if later a vulnerability is found, all of your passwords are at risk.


The most secure option probably would be to simply 'sync' the database files yourself (i.e. copy it to your other devices).


LastPass and KeePass are both considered good.
I am using (and would recommend) KeePass. LastPass is not open-source, while KeePass is.

I definitely wouldn't use some browser-in-built password manager.

Or KeePassX (linux)  :)

I'm using LastPass.

There are some drawbacks that I'm not sure if they are related with the add-on itself or with my web browser (Google Chrome in the past and Chromium now on Linux).

At the beginning LastPass was flawless and worked like a charm. Lately, many sites are not showing up the context menu at the side of the "username" and "password" fields that would allow us to click and fill the data into those fields.

I'm using different pseudo-random passwords with a specific minimum number of chars (of all types) when sites allow that minimum number of chars for every site. So, no repeated passwords. Master Password is not random, though (maybe I have a flaw here). Anyways, I save an exported backup of all my passwords in LastPass in an encrypted volume but with a few twists to try to increase security. I save the passwords in a plaintext file that I encrypt with GPG, then I copy that file into the encrypted volume and lastely, I encrypt the file that is the encrypted volume itself. So my passwords are on my laptop hard drive but triple encrypted. Hope this makes any smart ass, that attempts to steal my passwords, life harder...

It completely depends with the password manager you're using though. Some password managers are open-source, which you could compile yourself. If security is your main concern, the best choice would probably be KeePass[1].

---

[1] https://keepass.info/

The reason i recommend KeePassXC over KeePassX because :
1. KeePassX hasn't been updated since Sep 4, 2016 according to https://github.com/keepassx/keepassx/releases (https://github.com/keepassx/keepassx/releases) & https://www.keepassx.org/news (https://www.keepassx.org/news)
2. KeePassXC latest release is Jun 11, 2019 - 22:00 CEST according to https://keepassxc.org/blog/ (https://keepassxc.org/blog/)
3. KeePassXC have some difference, see https://superuser.com/a/879013 (https://superuser.com/a/879013)

I'm sure you prefer not to use outdated software :)

I researched Keepass in connection to keyloggers and found a test performed by malwaretips.com in 2015. They suggest that Keepass users should switch to Secure Desktop and use two-channel auto-type obfuscation whenever possible.

Without Secure Desktop several keyloggers were able to capture whole or parts of the passwords.

More about that here:
https://malwaretips.com/threads/keepass-vs-keyloggers.45891/

https://malwaretips.com/proxy.php?image=http%3A%2F%2Fi.imgur.com%2FD4qU5u9.png&hash=5588807ef015291e5d0e82085b6c9c94

I only use Firefox password manager for some time, and I was never hacked because of that. User can set master password, which you need to type first time you open browser and try to login to some site for which you save password. But after that if you leave your browser open and unattended, anyone can login to any site where you have saved password.

This is something I did not like, and in addition to that I did not know how safe is to save my passwords in browser, so I decide to stop with that practice. I may be old-fashioned, but paper is still best option for such data.

Why not?
Firefox has a masterpassword, so my password will be encrypted as well. Is it because it cannot generate new passwords randomly?



But you will end up repeating a lot of passwords this way, and it is much more uncomfortable to reach your paper. Storing passwords in cloud is very comfortable as you can access your passwords on the phone, tablet, other computer you trust (like at work) etc


Thanks everyone for the answers, i will probably use keepass :)

Mostly because on the one side browser are very prone to being exploited. I know, this theoretically applies to each software, but browsers are software used by everyone. They are targeted way often.

And on the other hand i don't want my password storage to directly be connected to internet.
A 0-day exploit in the browsers password manager could lead to all of my passwords being leaked by simply visiting a malicious website.
A 0-day exploit in a password manager, is not as severe as one in a browser. My machine would have to be compromised first. And in this case, i'd be already in trouble.

So basically.. the reason for me is security.




Those are some good points.
I agree with you.

KeePassXC > KeePassX




And you are definitely right.
I am going to migrate from KeePassX to XC. Thanks for the info  :)

I advise you to use Google chrome attached to g-mail - it will create an automatic password and if you connect your e-mail with validation key nobody will hack you :)

I decided to download KeePassXC and migrate all my password data there.
But I am having some troubles:

https://keepassxc.org/download/
No android version on the website.

I looked at firefox addons for mobile, and couldn't find it also.
https://addons.mozilla.org/en-US/android/search=?q=Keepass


So, this is a deal breaker to me. i need them on my android browser.

I will try bitwarden then.
I downloaded it for firefox android, and it is also marked as a recommend extension by Mozilla store.


Edit:
Also, one more question for you guys who knows a lot of this geek stuff. Should I use on my Android the Bitwarden App, or the Bitwarden Addon for firefox android? Any security or convenience difference?
https://play.google.com/store/apps/details?id=com.x8bit.bitwarden
http://addons.mozilla.org/en-us/android/addon/bitwarden-password-manager/

I tried a bunch of password managers do far,
and I did not found KeePass to be good enough for me.

There is also Android version KeePassDX
last updated November 1, 2018
https://www.keepassdx.com/

There is also KeeWeb
that is updated, and support all platforms + offline web.
Open Source
https://keeweb.info/
https://github.com/keeweb/keeweb/releases
 
Last option is  Buttercup
All platforms supported + browser extensions
Open Source
https://buttercup.pw/

I'm not sure about the security part, but the app version has a convenience advantage. With the Mozilla plugin, you can only use autofill on websites that you're opening through Mozilla Firefox, whereas the app, you can also use the autofill for the logins of the applications installed on your phone.

I was too dependent on password manager, with chrome. Now I cannot remove it from my life. But I think with the 2fa security code I can be safe with my money and accounts. I can't remember my passwords now LOL

Using password managers shouldn't be that bad, as long as you keep your device secure and your master password hard to guess and brute-force enough. I don't remember any password either besides my master password, as I use generated passwords for every single one of my online accounts anyway.

I don't see big differences regarding the security.

The sensitive information is encapsulated, either in the datafolder of the bitwarden app itself, or in the data folder of firefox.

One argument against the firefox addon might be an exploit in the browser which would allow a malicious website to eventually access some data.
I believe this would be slighly harder to accomplish using the application.

But that's more of a theoretical aspect. I don't think this plays a role practically.

Me too, I never used any password managers at all and I may/will consider using any password managers you have mentioned because I also read good comments about the password managers stated in the op but I will only use it to get password generated by the password manager.

I really don't know about which password manager is better to use when I also did not use any password manager. So, what I did is I only create my own password and if I can't think of any password, not strong password or very weak password then I will search passwords on the internet to get ideas on what password I will make or I will consider using password managers to generate different complex password and I will write it down on a paper then cover it with plastic cover or using a clear/transparent tape. The paper you use that you have written with your password will be strong and the paper won't be teared easily with the help of tape and that's what I do to help me remember my password if I happened to forgot my password.

Really interesting... Isn't there anything like that regarding LastPAss?

You guys are making it easy for hackers to find their potential targets. By posting in this thread, you are effectively telling hackers what password manager you are using and he does not have to search for ideal targets. So let's say this hacker knows about some exploit in one of these password managers and you post that you are using it, then he or she can just focus their phishing emails or hacks on you as a easy target.  ::)

Let's not make it easier for hackers to find their targets, by revealing sensitive information like this on a public forum.  ::)

I think you're exaggerating with this, it is all about passwords manager in general, and I doubt that any info presented here can help hackers to select a specific target. If any hacker know how to use some exploit in most popular password managers, then anyone using such software will be in danger.

I did not see that anyone is posting e-mails in this thread, but some members have them shown in their profiles which is not smart move for sure. I'm glad hackers will not get my passwords, then first need to send me e-mail and ask me to deliver them my papers ::)

A search led me to another security test that reviewed 1Password, Dashlane, KeePass and LastPass.

The full article is available here:
https://www.helpnetsecurity.com/2019/02/20/flawed-password-managers-allow-malware-to-steal-passwords-from-computer-memory/

The article mentions:

https://www.helpnetsecurity.com/images/posts2019/pass-managers-inmemory-secrets.jpg


The article ends with a suggestion that users need to make sure to completely shut down password managers when they are not being used and use full disk encryption to prevent the possibility of a memory dump and other leakages.

There is also a quote from LastPass CTO Sandor Palfy who says:

The full article is available here:
https://www.helpnetsecurity.com/2019/02/20/flawed-password-managers-allow-malware-to-steal-passwords-from-computer-memory/

That's nonsense.
This does not give an potential attacker any advantage at all.

He'd still need to compromise my system.
And once my system is compromised, he can scan all my files for which password manager i use and choose his malware accordingly.


Despite that if the machine is compromised, you have more to worry than 'just' your password manager which might or might not be exploitable.




Phishing is an completely social aspect.
If you fall for it, you fall for it. Doesn't matter which password manager you are using.

If your device is compromised, your password manager is too (at least after being opened the next time).

Which PW manager you use has no influence on the social aspects of phishing. I'd rather focus on the technical aspects in this discussion.

I've used Lastpass for years and love it. I haven't experienced anything wrong with their services

I read the full security article but to be honest I couldn't fully understand the table presented there. What means "Present", "Interacted", "YES", "NO" (2 last columns)? I'm not sure this means YES it was tested and Protected or YES it was tested and is vulnerable, or what... The other terms should also be explained. After reading the table I can only make assumptions about the meaning of each term used!

Anyway, thanks to @Pmalek that searched and found interesting info.

Now more important than that, and knowing that that article was posted around February 2019, it would be nice to know what (if any) efforts were made to improve security risks presented on that article!

darkV