What Password Manager do you use?

[AlTech]

As title says, what Password Manager do you use? And please post why you use it.

 

Thanks .

[kelvinhall05]

Lastpass because I learned about it first, but I kinda wish I could use something like Dashlane.

 

Also, my parents swear by 1Password, but IIRC it's a paid service, so that's a no for me.

[WereCat]

I dont use any. I remember all of my passwords, I just tend to forget which password I used for which account

[BlueChinchillaEatingDorito]

Never really found the need to. But since my laptop now has biometrics, would be something I'm interested in looking into one if it could take advantage of that hardware. 

[Enderman]

Google chrome.

[PeterPorker3]

Password managers DO NOT help with security because you are giving some random website all of your login info. Although, locally hosted ones do sound like better options. 

[AlTech]

Just now, MineParker101 said:

Password managers DO NOT help with security because you are giving some random website all of your login info.

For cloud hosted password managers, they usually encrypt your passwords and only locally decrypt them on the device.

 

For locally hosted password managers this isn't an issue.

[PeterPorker3]

Just now, AluminiumTech said:

For cloud hosted password managers, they usually encrypt your passwords and only locally decrypt them on the device.

 

For locally hosted password managers this isn't an issue.

That's what they say, how do you know that's actually what they do? That's what scarry to me.

[Razor Blade]

I use my own offline system...that's all I'm going to say.

[AlTech]

1 minute ago, MineParker101 said:

That's what they say, how do you know that's actually what they do? That's what scarry to me.

I don't find it scary. Because I know they don't just have every login unencrypted.

[Aleks NE]

LastPass; mainly for the simplicity and it was the first one I've tried.

[RumSwift]

I use Lastpass mainly because it's the one that was recommended to me when in university.

 

Not really done any research into many others because it works exactly how I want it to, so I've stuck by it.

[wasab]

I write all my passwords on a .txt file and then encrypts it and upload it to my Google drive. The most sensitive information like my bank account passwords are kept off my Chrome's auto complete while everything else I just use the Chrome's remember password features which will be sync when I sign into chrome on another device, like my phone for example. 

[kirashi]

On 9/3/2018 at 10:12 AM, AluminiumTech said:

I don't find it scary. Because I know they don't just have every login unencrypted.

How do you know though? Without access to the source code of their cloud platform, users have no way to guarantee what a company says vs. what they actually do with our data. While I'd like to believe that a company running a password managed does indeed encrypt the data I provide to them, I have no way to do this without access to at least their client source code.

 

This is much less of an issue with self-hosted password managers that are open source, such as those that sync their encrypted files DropBox, since I can review their code and even compile it myself to ensure there's nothing fishy going on with the encryption schema. This also lets me add my own hashed salting function too. That being said, I also just use a password schema I keep in my brain.

[AlTech]

4 hours ago, kirashi said:

How do you know though? Without access to the source code of their cloud platform, users have no way to guarantee what a company says vs. what they actually do with our data. While I'd like to believe that a company running a password managed does indeed encrypt the data I provide to them, I have no way to do this without access to at least their client source code.

If they did then they wouldn't have any customers.

[jpenguin]

Started with lasrpass fort a couple years, tried keepass for a while, then enpass, roboform & I'm currently using bitwarden

[kirashi]

16 hours ago, AluminiumTech said:

If they did then they wouldn't have any customers.

Not quite true - sure, the technically minded would take the client source code and run their own servers, paying absolutely nothing to the original developers, but the majority of people would still pay for the service because they're not skilled at configuring & maintaining their own servers for the service. This is sort of (very loosely) how the invoicing platform I use works.

 

InvoiceNinja offers both a self hosted and hosted version of their web-based invoicing system, and they're doing just fine for money. Myself and a bunch of the other active developers all use the free self-hosted option, but because the codebase is completely open source, we're able to contribute changes, improvements, and bugfixes directly back to the GitHub repo, which the lead developer then pushes out to the customers relying on their hosted platform.

 

This allows the community to ensure there are far fewer bugs, let alone security risks with the platform, while allowing the lead developer to turn what was a project to replace InvoicePlane into a viable business. This won't work with every type of service of course, but for many it allows speedier development of a service or platform compared to closed source alternatives.