Password Manager

GFox · March 26, 2023

On 3/23/2023 at 7:22 PM, Just Ori said:

While we're on the subject of hacking (hello, new to the forum, longtime LTT watcher) anyone got a good alternative to Lastpass? I don't mind paying either.

I don't understand how people fall for these scam VPN and online password vault scams. Just use keepassXC (on Android it's keepassDX and there's even an iOS version). It's open source so we know it isn't sending a plaintext copy of your passwords to someone's server, it's completely offline, and it's free.

If you must use a cloud based password manager the only one I can recommend is bitwarden since it's open source and undergoes frequent security audits by 3rd parties.

The thing about online password managers though is that they hold the credentials of millions of people, which makes them extremely attractive targets for cyber-criminals.

Keepass is designed to be nearly impossible to attack. Let's imagine a worst case scenario, devs make a mistake and after releasing an update introduce a zero day vulnerability, bad guys notice this and find a way to exploit it before it's identified and patched by the devs.. now they have.. exactly nothing lol.

Keepass is decentralized and the software or app itself doesn't contain any data, nor do they have a bunch of servers were data is stored (encrypted or otherwise). Users data are stored in encrypted database files that could be anywhere.. could be in an external drive or SD card somewhere, on a phone, in a Google drive, you never know, and there's no central entity to attack. Since you can store the database completely offline, there's no way to attack or reach it usually.

Plus keepass lets you customize everything from the encryption algorithm to the key derivation function and its individual parameters. But if that's too techy for you you can use the default settings and they're still plenty good.