- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
I went in to delete mine. Was forced to put in my real name and current employer without any way to opt out. So for a short brilliant moment I was Bobo Bobolicious of Bob’s Boat Oars
I don’t know if I have an account, but this is a good reminder to go through and review all of my accounts (everything’s in my password manager). I have way too many, so I could probably trim them.
Thanks for the reminder!
1 device: Keepass
2 or more devices Keepass + Syncthing
2 or more devices & extremely easy for new users: Bitwarden.
That works too. I have 4 devices (laptop, desktop, work computer, phone), and sometimes need to login on a device that’s not mine. I use Syncthing for other things, but Bitwarden has some nice features (e.g. organization to share passwords with my wife), so I stick with it.
Its a long journey, but totally worth it. When I chose to go fully self-hosted, I had around 1,200 accounts and passwords. First I used a temporary fake emailnsite to change my email and all the personal data I could from all the sites I wanted out of my life, then closed each account. Did a checkout wherever I could too. Then went into each account I wanted to keep where I was using a gmail address, changed my email to an alias (proton mail) and created a new random password for each (Bitwarden self-hosted). I’m down to about 100 accounts, including everything in my 2 jobs. The level of freedom I feel is unspeakable.
I thought I was bad with ~300 logins… I’m going to follow in your footsteps, teach me your ways sensei. :)
https://temp-mail.org/en/ That site, bitwarden (self-hosted preferably, but an account with them works too), and you’ve got all the tools you’ll ever want. If you also want to “change” your phone number on the sites you’re leaving (that’s always a good idea as well), you can try https://quackr.io/ but I’m not sure how good it is. I just found that site, and honestly can’t remember what I used for that. All I remember is that it was a free trial of an app for 7 days, and I made sure to finish that before the trial was over. And I’m no sensei, call me Master “4th run of Horizon Zero Dawn” 🤣🤣. Just kidding, I’m just a guy that, like most of is, got tired of all the BS out there these days. I am, though, on my 4th run of that game. Good luck man, you won’t regret doing this.
This is something that pisses me off about “Identity Monitoring Programs”; I have one because Experian fucked up and I got it for free for a year – but all I ever get is “Your account was found on the dark web!”
But then they won’t tell me WTF ACCOUNT it was!!
That’s one benefit of password managers, many offer a scan to figure out which usernames/passwords were exposed. I just checked, and I have 22 passwords exposed in a breach, but unfortunately I can’t do anything about most of them (i.e. they’re assigned from work).
I honestly don’t see any value in monitoring services from the big bureaus, you’re probably better off using:
If you can do those, you’ll probably catch anything before it becomes a serious issue.
Yeah, I already use a password manager - and do scan after stuff, but still am not matching things up to accounts. I think they’re just seeing my email (in general) and alerting me. Also use TOTP 2FA and additionally have a proper FIDO security token.
What’s a good multiplatform password manager these days? I’ve been meaning to move away from LastPass for forever (and update my passwords in the process), I just haven’t found the time to sort through all of that.
I really like BitWarden. Benefits:
It has some neat features and hasn’t annoyed me too much yet.
Also nearly complete rolling out Keypass/Webauthn compatibility!
Perfect, thank you!
I just moved from Dashlane it was painless
Bit warden
I’ll have a look, thanks
Say what you want about old timers but [ Notebook and Pencil ] has a 100% success rate if the attacker doesn’t have physical access.
Actually, that would make it easier to fall for a phishing page. My browser extension will only offer to fill example.com. If I’m on exarnple.com, it won’t. This makes me say “hmm, why no match for this page? ah! the domain is different”. With a notebook, I’d happily type the password in just the same.
PEBKAC isn’t really an argument greater than a Strawman. If you’re saying operators can’t be trusted to be competent you might as well argue that these people shouldn’t own computers or cellphones, or kitchen knifes or other things that require a minimum competence.
Sure, but that’s where the cross platform comes in, because I’d rather not have to lug said notebook around with me.
Convenience and Security are different goals. You can either put security before or after convenience.
I’m gonna go for taking reasonable action of fortification and then try my luck.
And negative, usable security is a delicate balance of security and convenience. It employs various layers of usable redundant security methods that keep things to the best possible and reasonable level of security available, while also maintaining useful defense. If I were doing anything rendering me a target of a malicious actor, that’s a different story. But run of the mill individual passwords for each website/service coupled with 2FA along with password database encryption is enough to keep a nobody like me reasonably comfortable.
I’m not typing a 64-character random string from a notepad everytime I log in somewhere tho
And an encrypted vault probably has a near 100% success rate even if the attacker has access to it given a sufficient vault password.
KeePassXC
KeepassXC with iCloud sync is my setup at the moment.
With iCloud? Really? Just WAO!
It’s an encrypted database and I am not tech savvy enough to self host a sync service.
I get it, and I’m sorry that I cake across as insensitive to that. Reading my comment again, I can see that I sounded just like an “Arch Master Race” Looney. On the other hand, none of us knew how to self-host, but each of the ones that do it now, learned. It’s about privacy and how much you want to move away from our dependence on big tech (privacy). You could start with something as simple as SyncThing on your computer, and slowly scale from there as you learn. I would even argue that you could use something like sync.com, only to start at least segregating who could potentially have your data, my understanding is that they run a zero-knowledge model, even for the free tier. More importantly, suggesting to others to use Apple, Google, Microsoft or any of the other huge offenders out there, you could be looked down upon as a troll by in these privacy instances. I hope you can get away from Apple’s grasp as much as possible at some point, and feel free to come and ask, many of us have already walked the rockiest roads to that freedom, and we’re more than willing to share and help. Good luck.
Thanks for the advice!
My Apple devices are from work and we are able to use them privately with admin rights. On my private account I have mostly open source software like Quodlibet for my music collection, Firefox, Inkscape, and so on. My Mailaccount is from a small German privacy by design provider. I have a Synology NAS I run Paperless NGX and Jellyfin on. I switch Operating systems regularly.
I think I am well set up 😁.
Yes you are Sir. You’re on the greener side of the fence, for sure.
I question whether a lot of people even need sync.
Passwords in general don’t change for long periods of time. Really the only rationale for doing so is confirmed or suspected compromise (two-factor processes make this rarer still). It doesn’t strike me that an almost permanently static input merits regular synchronization.
The alternative is doing a one-off manual sync (copy and paste) between two local DBs, then locally moving one of them to the target device. Zero online connectivity has to dramatically reduce attack surface. Is five minutes’ maintenance per year an unacceptable convenience penalty to pay?