1017
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 12 Mar 2024
1017 points (99.3% liked)
Technology
59708 readers
1541 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
And people still think they can trust password managers lmao
Why? What's wrong with Keepass?
Who knows? I just keep track of my own passwords so when the rest of you find out I won't be a part of it lol. Everyone on lemmy is so anti Google and anti Microsoft because of what they do with your data, that it's actually hilarious that so many just freely give EVERY SINGLE PASSWORD for their accounts to password management apps, like nothing bad could ever come from it.
If you can keep track of your passwords yourself, why take such a massive gamble?
That works great when you're young, kid, bit when you get older, you're going to be forgetting and resetting a lot of those passwords.
I don't think anyone on lemmy is under 30 lol
You're smarter than the collective wisdom of the entire cybersecurity community, I see. Researchers who have been doing this for decades have nothing on you. People with peer-reviewed studies and bucketloads of data are like pawns in the face of your vast intellect. When FOSS password managers fall, you'll be the only one left standing and the world will bow at your feet. Certainly you are the first person to have ever thought of this.
Be a sarcastic ass all you want, at least I can remember a password without relying on some random company lol. You keep giving all your passwords away though, no skin off my back
One password. Yes, that's the problem. Thank you for so eloquently disassembling your own inane point.
I'm sorry you can't even remember one. Maybe work on reading comprehension first. Have a great life!
You said "a password." That's one. I think my reading comprehension is just fine, but I admire your commitment to misunderstanding the point at every turn. It solidly explains why you're against password managers when literally everyone who knows anything about Internet security is for them.
Oh, I can remember far more than one. But I can't remember the 687 that I have currently stored in Bitwarden. Can you? Can you accurately and correctly remember six hundred and eighty-seven unique and distinct passwords? 687 unique and distinct passwords that are long and complex enough to be difficult to guess? Can you constantly monitor all 687 accounts for when they show up in data breaches? Can you recognize all 687 login screens for when they're spoofed for a phishing attack? Remember, some of those are banks! You've probably given a couple of them your SSN! There are 687 potential land mines out there. Good luck!
Jfc I don't fucking care whether or not you believe me, do whatever you want with your passwords.
I could use "A" breath of fresh air
I could go for "A" bite of pizza
I can remember "A" password where you can't
Next time use context clues
Now please shut the fuck up, this entire interaction with you has been enough for the rest of my life, and at this point you're literally the last person I would ever listen to about passwords. Have a good "A"!
I also don't like to be wrong, so I understand why you're lashing out. And oh for the love of God please don't listen to me about passwords! I'm not a security professional. I'm just saying you should listen to the people who are, not just go with your gut feeling about what a safe way of securing your online life is.
Lashing out =/= defending myself and refusing to put up with your bullshit. I said why I don't use password managers and you enter the conversation being a sarcastic asshole. I don't have to put up with that, call it lashing out or whatever the fuck you want but if you can't handle the heat then stay out of the kitchen. Now fuck off already.
You arrogantly said why you don't use password managers and I pointed out how your premise is incorrect and there's data to prove it; like this report from two years ago that cracking an encrypted password vault is orders of magnitude harder than cracking a password you can actually remember, or a report from a year and a half ago that not using one makes you three times more likely to experience identity theft. I pointed this out sarcastically, because you gave your opinion arrogantly. Since then, and since you've reacted with such anger and vitriol, I've turned the sarcasm down. I'm sorry that I hurt you with that joking response at the start.
But I'm not going to stop fact checking you in this thread because I don't want someone else seeing this and thinking that our positions are equally based on fact. They're not. You have a feeling; I have facts.
If you want me to stop, then stop posting misinformation.
Keep ass?
Sign me up!
OK, but you need to come down to the War Farts Center.
https://github.com/bitwarden/
Yeah, those. Thanks for the example.
So is your problem with using a password manager at all, or just the companies/sources of them?
Any company trying to get my data, really, and my passwords are the most sensitive of my data. Even if I coded one myself, and kept it completely local, my passwords are all in one place if that device gets compromised.
I can remember my passwords, so why take the gamble?
Well, you do you, but I'm happier with complex unique password locked behind a 2FA open source self hosted encrypted vault than I am remembering a few passwords shared amongst services. I have 400+ entries in it, and if I get hit by a bus, my wife has access to it with her yubikey.
You do you as well, one of the amazing things about all the technology we have available to us lol.
Because by not using a password manager I guarantee you are duplicating passwords between services. This means the second a service you use is compromised, every single service you use with that same email/password combination is compromised. Even if every one of your passwords had a slight deviation malicious actors know people do this and will likely be able to write a program that attempts those deviations on other services. You're effectively leaving your security up to weakest link in services you sign up for, and security is more often implemented poorly than implemented well.
By using a password manager you generate a 20+ character long password that is unique to each service you use. These passwords being random and unique to each service protects you from rainbow tables and other hash table based attacks. In the event Bitwarden or another password manager you use is breached anything they get will be worthless as long as your master password is not compromised (which should only ever exist in your head) due to the data being encrypted at rest.
It is a similar concept to using a secure, trusted middleman for processing payments instead of giving your credit card to every single site that asks for it.
Just curious, how do you know they're secure? Like how do you know it's only local and not being uploaded somewhere? I'm not about to tear through the code of open source password manager apps to make sure it's "safe" when I can keep track of them myself, but yes, I do see your point about that not being as safe as them being completely randomly generated for each account
The great thing about open source is that anyone can read the code. Even if you don't read every line yourself there are others who will. In popular projects it's pretty much a guarantee any suspicious or malicious changes get caught almost immediately due to the visibility of everything.
As for local-only I trust Bitwarden and their encryption schemes enough that I use their cloud sync, but you can always self host it in a Docker container with no Internet access if you're concerned about it.
People should consider using a double-blind scheme with cloud-connected managers.
The service you're setting a password for gets the actual credential, being two components , whereas the manager gets only
Consider the example of
U})wJAL0}RhIr')Rgs{,&^>I3/versusU})wJAL0}RhIr')Rgs{,&^>I3/basedIt protects against password database compromise at least. Keyloggers, MITM, etc. are another matter.