- Thread starter JOEPRO
- Start date
lazybones51
Member
- Messages
- 429
- Location
- Northamptonshire, UK
Bit Warden (free) or 1Password (Paid) are the two I would recommend. I personally use 1Password, but Bit Warden is very highly rated as well, and it also has a free tier. I'd avoid LastPass like the plague, as they don't have a good security track record.
keepassdx because it uses a standard database in the open keepass format that I can use on pc's etc without modification. And I lock/unlock the database with a hardware 2fa key (yubikey with nfc), though you can use a password if you dont mind being less secure. This way if my phone is stolen, and somehow they manage to unlock it with a hack etc, they still cant open the password manager without the 2fa key and the keystore unlock password.
If I dont care about the credential, I let google store it.
If I dont care about the credential, I let google store it.
Jaeger_S2k
Forum Supporter
- Messages
- 821
- Location
- Highfurlong, Blackpool. Lancashire
Hi Joe,
I've been using KeePass Password Safe, on my PC forever.
I also have it's android equivalent, keepass2android.
It then synchronises on Google Drive all my passwords and keeps everything updated.
If I create a password on the PC, it merges and updates my android and vice versa.
Takes a bit of learning, but it's a great addition to both and completely free.
I've been using KeePass Password Safe, on my PC forever.
I also have it's android equivalent, keepass2android.
It then synchronises on Google Drive all my passwords and keeps everything updated.
If I create a password on the PC, it merges and updates my android and vice versa.
Takes a bit of learning, but it's a great addition to both and completely free.
Jaeger_S2k
Forum Supporter
- Messages
- 821
- Location
- Highfurlong, Blackpool. Lancashire
I use the fingerprint reader to unlock on laptop and phone, so much easier now.
MetalMonkey
Member
- Messages
- 3,588
- Location
- UK
Another vote for keepass, used it for years on my pc, hundreds of password in it so all I have to do is copy the database to the phone and I have it all there if I need it.
skotl
Forum Supporter
- Messages
- 10,523
- Location
- Edinburgh, UK
+1 for Bitwarden - I use it on Windows, Linux and iPhone so, if it has an Android client, I would definitely recommend it.
dieselsamurai
Too many projects not enough time!
- Messages
- 1,657
- Location
- Hampshire
The only one we are allowed to install on work laptops and phones is Keepass
mart
Member
- Messages
- 1,980
- Location
- South Yorks
Hi
I am not sure if you are wanting to have the same password for all log ins.I have read that it is apparently not a good idea.
However, I always feel that a bit of ink is better than a good memory. Hence I have a note book with the website & password wrote down.
But Every password has a 2 digit number on the end. So for axample if the last two digits are 23 I would write house if that was my house number, or if part of car reg use Toyota as a prompt.
dieselsamurai
Too many projects not enough time!
- Messages
- 1,657
- Location
- Hampshire
Three random words with some number substitutions for letters IE O for 0 or 5 for S and a random character is probably one of the most secure we have always been told
Just checked my password manager and I have over 70 for just my work passwords alone !
Just checked my password manager and I have over 70 for just my work passwords alone !
- Messages
- 24,239
- Location
- Birmingham
Last place I worked wanted passwords changed every few weeks so eventually I came up with using a word followed by month/year so a current one would be password325 so nice and easy to remember.
dieselsamurai
Too many projects not enough time!
- Messages
- 1,657
- Location
- Hampshire
Yeah for work Passwords I dont follow my advice above its something simple like that as its a pain when some companies set the screen lock time to some ridiculously short amount
Morrisman
Forum Supporter
- Messages
- 9,063
- Location
- Staffordshire, England
When I worked offshore we had to change the password on the mechanics shack PC every 3 weeks. God only knows why. Who is going to steal details of our daily logs or inventory, on a ship with 30 guys on it? And the technician would send us the new password, a random jumble of letters, numbers, symbols, that nobody could, or would, ever bother to remember.
So we wrote it on a piece of tape on the front of the PC, every 3 weeks.
The stupid thing was there was no limit to how many attempts you could make guessing it, you could try 1000 times and it wouldn’t stop you or lock you out.
- Messages
- 24,239
- Location
- Birmingham
The workshop PC was shared so you had to remember to log-off when you left it or you could find you had sent "naughty" emails to managers etc.
I use the same sort of system.
Knowing how to attack passwords to brute force them, adding random numerics to the end of a dictionary word, even one with 0 substituted for O etc is weak and will fall to a semi skilled attacker (there's a tool for this where you can add mutations to cover these). So you set up "tool" with mutations and trailing characters, and just let it run. The three random words variant is more secure, but there's tools that join dictionary words together for attacks though it gets a bit computationally expensive to do.
If you are using a password manager at this stage the best bet is let the password manager suggest a password, and turn the complexity up on its controls and add every character group type, so punctuations, special symbols, numerics etc, and set the length higher. The idea is that you should never have to type the thing in anywhere, so might as well make it as awkward as possible to bruteforce and stupidly long and complete gibberish. The longer a password not based on dictionary words is, the harder and more expensive it is to crack, as people use compute resources for this task, so there's a point when it becomes more expensive for the resource to crack than the actual benefit (unless you already stole someone elses compute resource access ergo its free).
Unlimited attempts being possible on a system before lockout is just really really bad security design on behalf of the system. Systems that specify a maximum length, and bar certain chars from passwords and tell you the disallowed chars are just badly implemented too.
I dont use the fingerprint reader on the phone, its nowhere near as secure & trustworthy a sytem as the isolated yubikey and I dont want to trade security for convienience. I dont share the db via google drive either. But I have good reason to be more paranoid than the average user, but everyone has their own calculations on this tradeoff and if its worth it to them...
One last point, if you do lock a keepass db with a password, write it down with pen and ink, and keep it somewhere very very secure, where in the event of your death your significant others will be able to find it, and unlock access to accounts etc. And make them aware how to access it. Or their job if you have a untimely demise suddenly one day will be 100x more miserable.
If you are using a password manager at this stage the best bet is let the password manager suggest a password, and turn the complexity up on its controls and add every character group type, so punctuations, special symbols, numerics etc, and set the length higher. The idea is that you should never have to type the thing in anywhere, so might as well make it as awkward as possible to bruteforce and stupidly long and complete gibberish. The longer a password not based on dictionary words is, the harder and more expensive it is to crack, as people use compute resources for this task, so there's a point when it becomes more expensive for the resource to crack than the actual benefit (unless you already stole someone elses compute resource access ergo its free).
Unlimited attempts being possible on a system before lockout is just really really bad security design on behalf of the system. Systems that specify a maximum length, and bar certain chars from passwords and tell you the disallowed chars are just badly implemented too.
I dont use the fingerprint reader on the phone, its nowhere near as secure & trustworthy a sytem as the isolated yubikey and I dont want to trade security for convienience. I dont share the db via google drive either. But I have good reason to be more paranoid than the average user, but everyone has their own calculations on this tradeoff and if its worth it to them...
One last point, if you do lock a keepass db with a password, write it down with pen and ink, and keep it somewhere very very secure, where in the event of your death your significant others will be able to find it, and unlock access to accounts etc. And make them aware how to access it. Or their job if you have a untimely demise suddenly one day will be 100x more miserable.
dieselsamurai
Too many projects not enough time!
- Messages
- 1,657
- Location
- Hampshire
Above is a very good point always tell at least one of those closest too you where to find the password for any secure method you have of storing them. My brother died and we had no way of accessing his computers and he had many , he encrypted everthing so a lot of important info and photos died with him
