It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can’t remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn’t tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.
Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don’t just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They’re not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser’s password storage is better than nothing. Don’t reuse passwords, use long randomly generated ones.
It’s free, it’s convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I’m preaching to the choir, but if even one of you decides to use a password manager after this then it’s an easy win.
Please, don’t wait. If you aren’t using a password manager right now, take a few minutes. You’ll thank yourself later.
Theoretically, it’s possible to store a encrypted database on someone else’s system in a way where they never have the ability to see its contents, as you encryption and decryption only ever happens in the client on your devices.
Whether this is actually done in a way that enforces that on various password managers is unknowable with proprietary code.
Personally I self-host vaultwarden. All the benefits of syncing my passwords across devices, but the server enabling that, runs on my hardware.
Firefox Sync is end-to-end encrypted. So Firefox’s password manager with syncing does this.
To use that remote encrypted db, you need a stored client side secret, and a customer service department that deals with users who have lost that. See also “mud puddle test”.
I’d not heard of the “mud puddle test” but I immediately thought that any provider that does that, is doing it wrong.
Unless there’s an exploit of which I’m unaware, my self-hosted solutions pass the mud puddle test.
Companies have to know about the mud puddle test, but then they have to make an informed decision about whether they want to pass it. Hard disk and data recovery companies have been known to employ grief counsellors to help their customers cope with finding out that their disk drive is too trashed for the data to be restored. Choosing to pass the mud puddle test puts the password manager company in the same position. Some customers may, in fact, expect that recovering from the mud puddle is one of the services they are paying the company for. It’s the same reason hosted databases like RDS are a thing. Either way though, the company should be transparent about how they handle this question.
I agree with all of that, I was just pointing out that “uploading all your passwords to someone else’s server” can be done in a way that isn’t silly. You’re preaching to the choir.
Though even then, the best way is for that server to be yours, not someone else’s. And it does come with advantages in terms of convenience.
The benefits of having my passwords on a server (even my own server) seem tiny compared to just occasionally having to type one into a second computer after generating it on the first. If I had used a dozen computers instead of two, maybe it would be something to think about.
I don’t understand.
You only use each passwords once? You never log in to things on a new device without the one on which you created the account on hand? You only ever need authentication on two devices?
I own half a dozen devices on which I might want to log into places, and on several occasions it has been extremely useful to be able to access my password database from a completely new device from anywhere in the world, with nothing but the memorized master credentials.
I don’t think you can argue that the advantages don’t exist, even if they aren’t useful to you personally.
For web browsing I use either my laptop or my phone, two devices. I could imagine having more but for now there are just those two.