Password Managers?

After looking at various password managers, (in my estimation) one of the most simple & secure is Password Safe ( https://pwsafe.org/ ), created by security expert Bruce Schneier. One of the reasons for this, is that it takes a somewhat no frills approach. It is offline, with no browser extension. Very simple to use. There is a portable version. It can be opened in read-only mode by default. It automatically saves/backs-up changes. When closed it automatically clears clipboard after copy/paste. It will automatically log out after idle set time.

Bruce Schneierā€™s blog ā€˜Schneier on Securityā€™ can be found here: https://www.schneier.com/

Alternatively, you could just create a password protected text file, & maybe store it on a USB drive. Although the encryption may not be quite as robust as a dedicated password manager. It would lack some of the bells & whistles, too.

7-Zip is also a very easy way to encrypt files, that boasts AES 256-bit encrytion.

I just use an excel file stored on an USB that I keep at home. I change my passwords only every 6 months and then I do a copy on a second pen drive. The only inconvenience is when I need a password and Iā€™m not at home, but normally I learn all the new passwords in a couple of weeks.

try reverse alpha numeric encryption with a rotating cipher.(144 times 10 to the 144th power possible combinations):rofl: (this is an absolutely evil encryption scheme)
simple alpha numeric substitution often makes very good password when you add special characters

Took them quite a while, but the audit is complete and no major issues reported. Iā€™m seriously evaluating Bitwarden now.

2 Likes

Iā€™ve been using it. Itā€™s decent. The browser integration leaves something to be desired in moving from LastPass.

Never had an issue with data loss and the server was extremely easy to set up and maintain.

I prefer the firefox extension to the Lastpass one, which was horribly slow and could only show 3 logins at a time. I do miss the more granular login expiration stuff; the longest I can set it to is 4 hours, which is under half my work day. I really want 12 hours there, so I need to login once per day.

Other than that it seems fine.

1 Like

Ehh, it doesnā€™t do domain matching quite as well, not automatically, that is.

It also doesnā€™t track custom fields, other than uname and password.

I think its a one man dev team. Not sure if he has a roadmap published, but he was quick to respond when i had questions a while back. It has a lot of potential.

1password also seems to be quite good, far more polished than lastpass from what ive seen.

Choice of solution really depends on what you need. There all decent and do some things better than others.

1 Like

It only seems to match top-level domains, yeah. Thatā€™s annoying.

1password isnā€™t free, so itā€™s really on a whole different level. Both Lastpass and Bitwarden are fully functional without paying a penny.

1 Like

1password is free to use as well, just not all features, similar to lastpass. In that case some people will pay for good security software. Bit warden also has a paid option.

No, 1password has a free trial, but after that you need to either buy the software outright or subscribe.

Both lastpass and bitwarden offer subscriptions, but they are only for extra features that most people really donā€™t need. Iā€™m a power user for sure, and Lastpass free is fine for me.

Its free up to a certain number of items i think (not sure on the limit if its still exists) the free trial is for the account full access stuff.

I do get where your coming from, and 1password is one of the more expensive options out there as well, just slightly more than lastpass depending on how you pay for it.

But cost doesnt necissarily make a password manager good or bad, so cost isnt a huge factor depending on what you need. If you need somthing that works ā„¢ without the hassle, some of the paid options are quite good. and like Google, if its free yourpaying for it in other ways. In the case of bitwarden and keepass its lack of money to develop it and difficulty of use for the latter in many use-cases. All have their good and bad. A unified working password manager for phone, browser, computer, and command line is a need for some and not for others.

From what I can tell from a quick google, 1password has a 30 day free trial and after that it goes read-only.

1password subscription is 50% more than Lastpass ($36/yr versus $24/yr). That doesnā€™t sound too egregious for such an important utility but again, most people can just use Lastpass for free, forever. So really itā€™s $36/yr versus $0/yr.

Lastpass is fully end-to-end encrypted. The vault does supposedly show ads, but I run uBlock Origin and very rarely use the vault anyway.

1 Like

30 day free trial is for an account. You can use it without (I think up to a certain number of entries) its read/respond only on a computer I think but read/write on a phone. Iā€™m trialing it atm (free).

Cost depends again on how you do it. Get it yearly with their discount card and its $2.30 compared to $2 to LastPass. Still more expensive, but also more polished.

Again it depends on what you want or need or are happy to pay for. All are good options depending on use case.

Itā€™s really $2.30 versus $0.00 for Lastpass or Bitwarden, but your point about this being a very small amount of money for such an important utility is well made.

1 Like

After using it for a full day, Iā€™m going back to LastPass.

I do like the Bitwarden extension a bit more, but operation is still a bit hinky. It doesnā€™t recognize new logins sometimes, autofill works inconsistently, and it doesnā€™t support secure notes over 10k characters, which is not very long.

Iā€™ll check it out again in another year once itā€™s had a chance to marinate.

2 Likes

Thatā€™s great, thanks for posting.

Yeah, for me, 2 things need to happen. It needs more than one caretaker, and I need to know that they will continue to audit, not just this one time.

Yeah, Iā€™m interested in seeing more people brought into the maintainership as well. Bus factor is a major Achilles heel right now.

Iā€™ve taken the plunge with lastpassā€¦ Opera browser integration is pretty good, just have to train it a bit with some work websites I use. Got about 70% of my accounts switched over, gonna try to get the rest of them converted over by the end of the day but so far happy with it.

Itā€™s great software.

Be sure to setup 2FA and use a 14+ character passphrase.