Forum Topics Online Security
umop3pisdn
3 years ago

Thanks for all the responses!

Many of you say that you use a free product/service to manage your passwords.

Are any of you concerned that because you're not paying for the service, your data may be compromised/sold?

7

Remorhaz
3 years ago

Whilst you may be up for marketing from using one of these free (or paid) services. In most (all) cases I'm aware of, the design of the password managers is such that the vendors never actually see your data (in an unencrypted form). All data is encrypted client side using your "master password" and only the encrypted data is transferred to or stored in the cloud. This is why for these services if you loose your master password your data is basically toast (i.e. they can't decrypt or unlock it for you)

8

reddogaustin
3 years ago

As @Remorhaz has pointed out, the data itself is secure with free versions.

What gets sold more readily with the free versions is your patterns and behaviour - what sites you visit, how often, perhaps even your config choices for passwords etc (ie 15% of users have passwords that are 14 characters or less in length). This is marketable data on the internet (and what facebook does mercilessly in the background).

9
Shapeshifter
3 years ago

I switched from LastPass to Bitwarden. Mainly because LastPass wanted to charge for usage on multiple devices.

Bitwarden works well and is free to use on multiple devices.

9

Remorhaz
3 years ago

Yep I almost did the same (Bitwarden was the best next option from my research) - the progressive removal of features from the free version of Lastpass was getting more annoying and for me the multi device limit was the last straw (in the end it basically forced me to go paid - and I went family paid anyway to get the benefit for my whole family)

8
Figgy
3 years ago

I have been using Dashlane for years. I have some sort of weird half premium version for signing up very early but am considering their family plan which gives multiple licenses. As usual great if you own the business but SaaS on the consumer side sucks as there is not much in the way of innovation / features being added year after year.

Apple Keychain may be something I move to if it becomes better, but most third party password managers are platform agnostic (and works well on my phone too)

7
umop3pisdn
3 years ago

Happy New Year Strawfolk!

I've been spending my time of late consuming various podcasts, with the most recent being Darknet Diaries

One of the sponsors mentioned in an early episode is 1Password.com

With all of the passwords I have for each of the share registries, along with all of my personal online accounts, this service sounds right up my alley. I'm so sick of having to go through the process of recovering my passwords.

This got me wondering if anyone else had any great tips for managing and securing our online identities? With a collective group of investors I figure this is would be top of the list of priorities for modern investing.

14

shadow
3 years ago

Yubikey - unfortunately none of the banks or brokers in Australia support hardware authentication but I use it to secure my email where verification codes go to.

Also works with major password managers.

9

Chagsy
3 years ago

Apple keychain. I get it to generate some huge random collection of digits and letters and remember it for me. Obviously, you need to be a Mac user.

9

Remorhaz
3 years ago

I had a 1Password licence a long long time ago - at the time it was Mac only

I've been using Lastpass for the past half dozen or more years (they have however been slowly limiting features from the free version and making them only available to the paid). I switched to the families version a year back (so my whole family could make use of it (and securely share certain accounts, notes, etc)

I also use it in conjunction with MFA/2FA capabilities where available (e.g. TOPT (like Authy <- this is my preferred software token app (also works on my watch), Google Authenticator, MS Auth, etc) and Yubikeys (tho not very many sites/services actually support Yubikey (U2F) natively (Lastpass does (paid version)) so I'm often just using the TOPT capabilities of the Yubikey instead)

10

reddogaustin
3 years ago

+1 for LastPass - free version - works for my lifestyle / device combo. Depending on your device combo/lifestyle you may want a paid password manager.

Even using the inbuilt browser password managers is better than nothing at all.

Also, consider this "discussion" https://protonmail.com/blog/protonmail-com-blog-password-vs-passphrase/

11

Rocket6
3 years ago

I recommend LastPass too, an excellent password manager that I am very happy with - and have been for well over a year.

I use the free version - have a stack of passwords but can only use one device (phone). This suits me for the time being. That said, I would have no hesitation buying the premium version if my circumstances changed.

10