Password Managers - Worth it?
Discussion
I’ve been using the simple Apple Keychain to store a few passwords for forums and whatnot but have never stored anything overly important in there. Reading online it seems I’m doing it wrong and I should be using these to store EVERYTHING!
I’ve always felt a bit uncertain about having log ins for financial type things stored in these - am I being unnecessarily cautious? I do quite like the complexity / length of the passwords these generate and obviously it’s much easier to keep all of them totally unique from one another with no crossover etc.
Curious to know if others are using them for the important stuff, and if there’s any benefit to getting one of specific stand-alone apps over the basic Apple one?
I’ve always felt a bit uncertain about having log ins for financial type things stored in these - am I being unnecessarily cautious? I do quite like the complexity / length of the passwords these generate and obviously it’s much easier to keep all of them totally unique from one another with no crossover etc.
Curious to know if others are using them for the important stuff, and if there’s any benefit to getting one of specific stand-alone apps over the basic Apple one?
They seem to be the least bad option. You either have the same password for lots of things, write it down in a book, or use a password manager. Yes you’re relying on someone else’s encryption, and if I was being chased by the CIA, I’d probably go back to writing stuff down, but they’re good enough.
If find that Bitwarden is very good cross platform, especially with face_ID on an iPad.
If find that Bitwarden is very good cross platform, especially with face_ID on an iPad.
rxe said:
...You either have the same password for lots of things, write it down in a book, or use a password manager.
There is another way - you can devise a system for passwords; create your own algorithm based on abstract parts of the thing you're signing up for. For example, a country starting with the second letter, an animal beginning with the last but one letter, the number of vowels multiplied by 3 and the number of letter S.google.com = Oman-Lemur-90
pistonheads.com = Italy-Deer-152
You can obviously make a system as complicated as you like to generate strong, unique passwords without having to remember any of them. All you have to remember is the system, which is not likely to be guessed by a stranger even when (not "if" any more) one or more of those passwords are exposed.
I used this approach for many years. It only gets difficult when you run into different rules (like an 8 character limit).
That said, I eventually moved to a password manager. The main problem is that there are just so many that it's hard to keep track of what you have accounts for, and there are features like auto-changing passwords when you hear of a breach that are really useful.
Edited by durbster on Tuesday 1st June 08:55
durbster said:
rxe said:
...You either have the same password for lots of things, write it down in a book, or use a password manager.
There is another way - you can devise a system for passwords; create your own algorithm based on abstract parts of the thing you're signing up for. For example, a country starting with the second letter, an animal beginning with the last but one letter, the number of vowels multiplied by 3 and the number of letter S.google.com = Oman-Lemur-90
pistonheads.com = Italy-Deer-152
You can obviously make a system as complicated as you like to generate strong, unique passwords without having to remember any of them. All you have to remember is the system, which is not likely to be guessed by a stranger even when (not "if" any more) one or more of those passwords are exposed.
I used this approach for many years. It only gets difficult when you run into different rules (like an 8 character limit).
That said, I eventually moved to a password manager. The main problem is that there are just so many that it's hard to keep track of what you have accounts for, and there are features like auto-changing passwords when you hear of a breach that are really useful.
Edited by durbster on Tuesday 1st June 08:55
Given the number of accounts & devices we all have these days I'd say a PWM is an important thing to use. You can decide for yourself if you want the database held on a central server (eg LastPass, BitWarden, 1Password) or if you want to store it yourself (eg Keepass). I used to use LastPass but dropped it when they raised the price & now I use BitWarden & find it better than LastPass.
The big advanatge is that it syncs across pretty much all platforms so I can change a password on my PC & it will be updated on my phone. If you were completely Apple then maybe you could achieve the same but I'm not. As long as I can type my strong master password into a device I can get login & password auto-filled when needed.
There are a number of other features you might find useful; Bitwarden can auto-fill credit card details & you can store files & documents securely. I know you can do that with Dropbox or OneDrive but it's a useful place to access items in an emergency. You can also arrange for emergency access so if you are dead or incapacitated your family will be able to access your passwords.
The big advanatge is that it syncs across pretty much all platforms so I can change a password on my PC & it will be updated on my phone. If you were completely Apple then maybe you could achieve the same but I'm not. As long as I can type my strong master password into a device I can get login & password auto-filled when needed.
There are a number of other features you might find useful; Bitwarden can auto-fill credit card details & you can store files & documents securely. I know you can do that with Dropbox or OneDrive but it's a useful place to access items in an emergency. You can also arrange for emergency access so if you are dead or incapacitated your family will be able to access your passwords.
Moley RUFC said:
Very useful that and something I may follow myself albeit I can’t help but think of Alan Partridge reading that out.
Don't. Just don't. It's an unusable scheme if you have more than a few passwords & even the person who posted it has dropped it for a PWM. You'll find that at some crucial point when you're stressed out & it's vital that you log in somewhere that you can't remember if it's Italy-Deer-152 or Iran-Dingo-152.Mr Pointy said:
Moley RUFC said:
Very useful that and something I may follow myself albeit I can’t help but think of Alan Partridge reading that out.
Don't. Just don't. It's an unusable scheme if you have more than a few passwords & even the person who posted it has dropped it for a PWM. You'll find that at some crucial point when you're stressed out & it's vital that you log in somewhere that you can't remember if it's Italy-Deer-152 or Iran-Dingo-152.Like most I thoroughly recommend using one.
From other threads on here I know I am far from alone in using KeePass (KeePass 2 more accurately) which is free and available for many platforms. Down side is you need a local data file, upside is you can cloud share it so I keep mine on my Dropbox account and just point the app there (or click to open it from within DropBox on my Android phone and iPad).
edit - changed database to data file to avoid confusion or a misunderstanding of requirements (as it creates the secure file when you first use it).
From other threads on here I know I am far from alone in using KeePass (KeePass 2 more accurately) which is free and available for many platforms. Down side is you need a local data file, upside is you can cloud share it so I keep mine on my Dropbox account and just point the app there (or click to open it from within DropBox on my Android phone and iPad).
edit - changed database to data file to avoid confusion or a misunderstanding of requirements (as it creates the secure file when you first use it).
Edited by dapprman on Wednesday 2nd June 00:11
Mr Pointy said:
Moley RUFC said:
Very useful that and something I may follow myself albeit I can’t help but think of Alan Partridge reading that out.
Don't. Just don't. It's an unusable scheme if you have more than a few passwords & even the person who posted it has dropped it for a PWM. You'll find that at some crucial point when you're stressed out & it's vital that you log in somewhere that you can't remember if it's Italy-Deer-152 or Iran-Dingo-152.
Oscar Kilo Another vote for. Password keeper, O use stickypassword, which I have a perpetual licence for, it's got me out of lots of sticky situations over the years, syncs across all my PCs and mobiles.
Only issue is sometimes it doesn't automatically link to new sites so I then don't get the new password stored unless I manually save it
Only issue is sometimes it doesn't automatically link to new sites so I then don't get the new password stored unless I manually save it
Browser saved passwords are also plenty secure. And carry less risk of being operated by a nefareous character.
NCSC suggests browser and thrid party are ok, so long as you check reviews.
https://www.ncsc.gov.uk/collection/top-tips-for-st...
NCSC suggests browser and thrid party are ok, so long as you check reviews.
https://www.ncsc.gov.uk/collection/top-tips-for-st...
I used firefox for all my passwords for a long time and it is good. I moved to 1password because that works across multiple browsers, which I often use to log into things as multiple users etc for working on different clients. You can also create little teams in it and share certain passwords out with people. Just depends what you need.
Taita said:
Mr Pointy said:
Moley RUFC said:
Very useful that and something I may follow myself albeit I can’t help but think of Alan Partridge reading that out.
Don't. Just don't. It's an unusable scheme if you have more than a few passwords & even the person who posted it has dropped it for a PWM. You'll find that at some crucial point when you're stressed out & it's vital that you log in somewhere that you can't remember if it's Italy-Deer-152 or Iran-Dingo-152.
I used this approach for almost a decade for hundreds of accounts and remembering the system was never a problem, and I could sign in on any machine without issue (which is a pain with PWMs).
As I said, the only issues were when the system I chose occasionally clashed with a site's validation rules (e.g. no special characters, or low character limits). For those I had a note on my phone saying what the odd rule was.
I agree a password manager is probably the best option overall but not everyone wants to do that, or can afford to pay for it, and this is far more practical than writing them all down and massively safer than re-using the same password over and over.
durbster said:
Err, maybe it wasn't clear but that was a simple example to illustrate the concept. Obviously you would choose things that are easy for you to remember.
I used this approach for almost a decade for hundreds of accounts and remembering the system was never a problem, and I could sign in on any machine without issue (which is a pain with PWMs).
As I said, the only issues were when the system I chose occasionally clashed with a site's validation rules (e.g. no special characters, or low character limits). For those I had a note on my phone saying what the odd rule was.
I agree a password manager is probably the best option overall but not everyone wants to do that, or can afford to pay for it, and this is far more practical than writing them all down and massively safer than re-using the same password over and over.
Are you saying you could remember hundreds of different two word combinations or did you just have 26 different words, one for each letter (ie the letter i was always Italy & d was always deer? I'd still suggest that would be a feat beyond most people.I used this approach for almost a decade for hundreds of accounts and remembering the system was never a problem, and I could sign in on any machine without issue (which is a pain with PWMs).
As I said, the only issues were when the system I chose occasionally clashed with a site's validation rules (e.g. no special characters, or low character limits). For those I had a note on my phone saying what the odd rule was.
I agree a password manager is probably the best option overall but not everyone wants to do that, or can afford to pay for it, and this is far more practical than writing them all down and massively safer than re-using the same password over and over.
Anyway, the main takeaway is that a PWM is a good thing.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff