Do you use a password manager?

[rdluffy]

Good thread to learn more about password managers
For now I only use Google's system for the sites I use the most, but I need to organize my passwords better and use a program for that
As time goes by, passwords become practically impossible to remember due to the many services we have and each one may require passwords of different lengths or with special characters

I think I'll give Keepass a try

Oh, I almost forgot, I have some passwords in my iPhone too, managed by Apple with my face recognition

[Lucius]

~snip~
Oh, I almost forgot, I have some passwords in my iPhone too, managed by Apple with my face recognition

I'm not sure, but I think I read somewhere that passwords from Apple devices are automatically stored in their cloud - although I may have misunderstood something. However, I think that locking with face recognition is not very reliable, and not only that someone else very similar to the owner can unlock the device, but also that in the case of a physical attack, the attacker can unlock the device very easily, but the level of security is similar with a fingerprint.

It is much better to use a PIN code, and to have all important things on the devices encrypted.

[bitmover]

As bitmover said, it isn't at all practical to store passwords on paper. In addition to having to leaf through them looking for the credentials, it is insecure by definition, because if someone finds your notebook, if it is a malicious person, your passwords have been compromised.

I get your point. Although some notebook comes with bookmark, where you can use it to split it either by alphabet or category (e.g. social media, exchange).

How do you generate these passwords? Are they being generated randomly? Password managers solve this problem.

FWIW, you could use password manager only to generate the password and write-down it on paper.

I Think the point is that we generate new passwords nearly every week.

Will you carry that piece of paper with you all the times? Yesterday I had to create a new account in a website to buy some suplements.
Then, a few days ago, I had to create an account in a new airlines company which I never used to travel to a place I have never been.

I used a password manager which syncs with my phone, so I don't need to care about noting those passwords down in a paper if I am not home when I create those accounts, for example.

It is very convenient and protonpass is safe. As I said, I see no problem if someone is able to login into this airline company with my email,. He cant buy anything, just see my past trips.

[ABCbits]

--snip--

I Think the point is that we generate new passwords nearly every week.

Will you carry that piece of paper with you all the times? Yesterday I had to create a new account in a website to buy some suplements.
Then, a few days ago, I had to create an account in a new airlines company which I never used to travel to a place I have never been.

I used a password manager which syncs with my phone, so I don't need to care about noting those passwords down in a paper if I am not home when I create those accounts, for example.

It is very convenient and protonpass is safe. As I said, I see no problem if someone is able to login into this airline company with my email,. He cant buy anything, just see my past trips.

In such case, i can see why using paper/book is less convenient or secure. While someone could write on separate paper while they're outside and write it again on their main paper/book, it only partially reduce security issue.

[libert19]

--snip--

I Think the point is that we generate new passwords nearly every week.

Will you carry that piece of paper with you all the times? Yesterday I had to create a new account in a website to buy some suplements.
Then, a few days ago, I had to create an account in a new airlines company which I never used to travel to a place I have never been.

I used a password manager which syncs with my phone, so I don't need to care about noting those passwords down in a paper if I am not home when I create those accounts, for example.

It is very convenient and protonpass is safe. As I said, I see no problem if someone is able to login into this airline company with my email,. He cant buy anything, just see my past trips.

In such case, i can see why using paper/book is less convenient or secure.

In this case? Paper backups are fragile and inconvenient by nature. Paper backups are only for those who don't trust anything on Internet.

I personally don't find appeal of it at all, offline password managers like Keepass are fine middle ground between convenience of online password managers and security of paper backups.

[rdluffy]

I'm not sure, but I think I read somewhere that passwords from Apple devices are automatically stored in their cloud - although I may have misunderstood something. However, I think that locking with face recognition is not very reliable, and not only that someone else very similar to the owner can unlock the device, but also that in the case of a physical attack, the attacker can unlock the device very easily, but the level of security is similar with a fingerprint.

It is much better to use a PIN code, and to have all important things on the devices encrypted.

Yes, it's called iCloud Keychain, according to Apple, it's encrypted and not even Apple can see your data
To be honest I don't know any other method to save the passwords of apps in my Iphone, I have a pin code and my facial recognition

At least my main crypto passwords are not stored on my phone

...
I Think the point is that we generate new passwords nearly every week.
...

Exactly, I think it's the same with me, 3 or 4 new passwords per month, almost impossible to manage without any app or browser password manager

I find very difficult when I have to help elder people to save their password

[joniboini]

Yes, it's called iCloud Keychain, according to Apple, it's encrypted and not even Apple can see your data
To be honest I don't know any other method to save the passwords of apps in my Iphone, I have a pin code and my facial recognition

I am a bit paranoid when a company says they can't see our data. Too many database leaks happened and some of them stored a password in plaintext even if they stated they use the latest encryption technology or whatever.

Have you tried a fork of KeePass or other password managers? I'm pretty sure there are forks of KeePass available for iPhone, though I never used one. IIRC KeePasium is one of them. CMIIW.

[libert19]

I'm not sure, but I think I read somewhere that passwords from Apple devices are automatically stored in their cloud - although I may have misunderstood something. However, I think that locking with face recognition is not very reliable, and not only that someone else very similar to the owner can unlock the device, but also that in the case of a physical attack, the attacker can unlock the device very easily, but the level of security is similar with a fingerprint.

It is much better to use a PIN code, and to have all important things on the devices encrypted.

Yes, it's called iCloud Keychain, according to Apple, it's encrypted and not even Apple can see your data
To be honest I don't know any other method to save the passwords of apps in my Iphone, I have a pin code and my facial recognition.

There was case sometime back where Metamask user got his assets wiped out because hacker got hold of his Metamask keystore from icloud, albeit mistake here was of user that he gave hacker code to access his icloud and his MM keystore password wasn't secure enough either.

You can read full story here: https://www.theblock.co/post/142304/metamask-advises-users-to-disable-automatic-icloud-backups-of-its-wallet-data-to-prevent-hacks

[taufik123]

Yes, it's called iCloud Keychain, according to Apple, it's encrypted and not even Apple can see your data
To be honest I don't know any other method to save the passwords of apps in my Iphone, I have a pin code and my facial recognition

I am a bit paranoid when a company says they can't see our data. Too many database leaks happened and some of them stored a password in plaintext even if they stated they use the latest encryption technology or whatever.
-snip-

It is just a technology boast and it is proven that many companies have experienced data leaks and user data in trading.
As in many cases in Indonesia that a few months ago went viral.

I've never even used a password management app, relying only on memories and a special note offline to record passwords

[bitmover]

I've never even used a password management app, relying only on memories and a special note offline to record passwords

I suggest that you try sometime.

It is much easier to use and very handful. Relying on memories and notes is less convenient and more insecure in most situations.

[Husna QA]

The Password* Manager feature that I use in the iPhone default application is not for storing seed phrases but for storing usernames/emails and passwords for access to certain accounts so that they can be automatically filled in when I want to log in. To open the Password feature, I set it using Face ID. Of course, I use other applications for accounts that use additional 2FA, and so far, I have used Authy.

I believe this uses an Apple account just like MacOS right? I also use them on my Macbook but I don't trust them enough to move all of my passwords over, not to mention I use other devices other than iOS/MacOS too. I also use Authy but I'm in the process of moving my OTP to FreeOTP and Aegis Authenticator. It takes a bit of time since they don't offer an export or backup feature at all.

Yes, the iPhone's Password application is the default application and uses an Apple account, so it is possible to connect to other devices that use the same application and account.

I only saved a few passwords on the application; even then, some still needed to open other 2FA applications.

-snip-
I've never even used a password management app, relying only on memories and a special note offline to record passwords

Or, at least if you are still in doubt, you can try saving a few less important passwords while testing the security of the password manager application you are using.

[libert19]

Yes, it's called iCloud Keychain, according to Apple, it's encrypted and not even Apple can see your data
To be honest I don't know any other method to save the passwords of apps in my Iphone, I have a pin code and my facial recognition

I am a bit paranoid when a company says they can't see our data. Too many database leaks happened and some of them stored a password in plaintext even if they stated they use the latest encryption technology or whatever.
-snip-

It is just a technology boast and it is proven that many companies have experienced data leaks and user data in trading.
As in many cases in Indonesia that a few months ago went viral.

I've never even used a password management app, relying only on memories and a special note offline to record passwords

Memory is fragile, and note taking is inconvenient. If you don't trust online password managers, try using offline ones — no data gets to Internet, no worry of data leak.

I use KeePassDX and Password Safe on android.

[Paragon2]

Do you use a password manager for your online accounts, exchanges, 2FA and wallets?

Which one do you use and why? Share your experiences.

What do you think of closed-source password managers like 1Password?

And open-source ones like Keepass?

Here is a comparison of most password managers (I don't know if the list is up to date), which may help you in your choice.

I used to save my password here on the device, but the chances of it getting hacked are high, but I now use the last password that I have written down in a notebook at the moment. 
Keeping it secure on the device will make your account more likely to be hacked if your device is lost, so the safest thing to do now is to set it to 2FA.

[bitmover]

Keeping it secure on the device will make your account more likely to be hacked if your device is lost, so the safest thing to do now is to set it to 2FA.

Passwords managers are encrypted,  so even if your device is lost no one can open and steal your passwords (unless they know your password for the password manager)

[Husna QA]

Do you use a password manager for your online accounts, exchanges, 2FA and wallets?
-snip-

I used to save my password here on the device, but the chances of it getting hacked are high, but I now use the last password that I have written down in a notebook at the moment. 
Keeping it secure on the device will make your account more likely to be hacked if your device is lost, so the safest thing to do now is to set it to 2FA.

Are the passwords you save on the device encrypted? If not, then obviously, storing it on a device (especially one connected to the internet) could be vulnerable to hacking.

Using the 2FA feature can be very helpful, but I don't think all your accounts have this feature, for example, accounts on Altcoinstalks.
The option is that you can use a password manager and save a backup on another device just in case one day you can't access the password manager for some reason.