Login change coming: enforcing non-compromised passwords

Forums › Geekzone › Login change coming: enforcing non-compromised passwords

1 | 2 | 3 | 4 | 5

meow
13580 posts

Uber Geek
+1 received by user: 10911

Moderator

ID Verified

Trusted

Lifetime subscriber

#2648115 5-Feb-2021 12:48

MurrayM:

I switched to using the KeePass password safe several years ago and I let it generate long random passwords for each site that I need an account on. Since I was able to log in just fine here a few minutes ago, I assume it's doing its job!

I've been using Bitwarden https://bitwarden.com/ which is a much nicer, opensource password manager with cloud storage and seriously really like it. Previously used LastPass and previous to that KeePass.

I've got several pwned passwords under my name but Geekzone ain't one!

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Eva888

2762 posts

Uber Geek
+1 received by user: 2427

Lifetime subscriber

#2648133 5-Feb-2021 13:08

Done but haven’t dared check all mine yet.

Bitwarden looks good except you need a master password to open all the stored ones...and you can’t forget or retrieve the master one. Not sure I trust myself to remember.

Question if I use bitwarden, does IPad still remember the passwords generated by it so there’s a sort of back up?

freitasm

BDFL - Memuneh
80653 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2648135 5-Feb-2021 13:12

Eva888: Done but haven’t dared check all mine yet.

Bitwarden looks good except you need a master password to open all the stored ones...and you can’t forget or retrieve the master one. Not sure I trust myself to remember.

Question if I use bitwarden, does IPad still remember the passwords generated by it so there’s a sort of back up?

Bitwarden, LastPass and others allow you to select an Emergency Contact that can access the password vault in case of need.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

michaelmurfy

meow
13580 posts

Uber Geek
+1 received by user: 10911

Moderator

ID Verified

Trusted

Lifetime subscriber

#2648150 5-Feb-2021 13:20

@Eva888 I just pay the $10 per year to them in order to have emergency access. My partner can "request" access to my vault and change my master password if needed. If you went with the families plan you could have others in your household as emergency contacts so if you forget your master password you won't lose anything (it'll just be annoying).

I have my browsers lock when I close them too so I need to enter my master password each time to unlock it. This refreshes my memory.

My iPad, iPhone etc all integrate nicely with Bitwarden - I get a brief face ID and suddenly I am able to autofill the login information for any site / app.

It is seriously worth doing even if it is annoying to set up at first. All my passwords are different between sites so if one gets pwned it doesn't affect the rest. Bitwarden also has have I been pwned integration and will notify you if the password you're using for any sites is pwned and prompt you to change it (yet to convince my parents they need to stop using some passwords!):

Senecio

2853 posts

Uber Geek
+1 received by user: 3163

ID Verified

Lifetime subscriber

#2648153 5-Feb-2021 13:26

Another +1 here for password managers. My wife and I use LastPass families. A little bit of work to set up initially but once done it is just so easy.

xpd

Geek of Coastguard
14116 posts

Uber Geek
+1 received by user: 4579

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#2648160 5-Feb-2021 13:41

I use Keepass and Lastpass - Keepass mainly has my "offline" stuff (local server etc) with a few core online ones. General websites sit in Last Pass.

Came across Bitwarden yesterday after a discussion at work about password security.... will take a further look.

XPD / Gavin

LinkTree

Geekzone support

Support Geekzone with one-off or recurring donations Donate via PressPatron.

Eva888

2762 posts

Uber Geek
+1 received by user: 2427

Lifetime subscriber

#2648161 5-Feb-2021 13:51

michaelmurfy:
@Eva888 I just pay the $10 per year to them in order to have emergency access. My partner can "request" access to my vault and change my master password if needed. If you went with the families plan you could have others in your household as emergency contacts so if you forget your master password you won't lose anything (it'll just be annoying).

I have my browsers lock when I close them too so I need to enter my master password each time to unlock it. This refreshes my memory.

My iPad, iPhone etc all integrate nicely with Bitwarden - I get a brief face ID and suddenly I am able to autofill the login information for any site / app.

It is seriously worth doing even if it is annoying to set up at first. All my passwords are different between sites so if one gets pwned it doesn't affect the rest. Bitwarden also has have I been pwned integration and will notify you if the password you're using for any sites is pwned and prompt you to change it (yet to convince my parents they need to stop using some passwords!):

Thanks for the explanation. Sounds good and $10 a year is nothing for peace of mind. Wonder if family means they need to have the same IP or can they be in another house. What would happen should one want to change to a different password manager say if the developers went bust or it was removed from the App Store.

Will look at it when I have plenty free time. Presently waiting for VF to get my internet back on so it has to wait.

tdgeek

30048 posts

Uber Geek
+1 received by user: 9455

Trusted

Lifetime subscriber

#2648164 5-Feb-2021 13:55

Eva888: you need a master password to open all the stored ones...and you can’t forget or retrieve the master one. Not sure I trust myself to remember.

That's why Post-It Notes and computer screens were invented... :-)

MurrayM

2502 posts

Uber Geek
+1 received by user: 742

ID Verified

Trusted

Lifetime subscriber

#2648213 5-Feb-2021 14:11

michaelmurfy:

I've been using Bitwarden https://bitwarden.com/ which is a much nicer, opensource password manager with cloud storage and seriously really like it. Previously used LastPass and previous to that KeePass.

Hmm, Bitwarden does indeed look nice. At the moment I run KeePass on my Linux and Windows machines, and Keepass2Android on my phone, and have them all share a password DB that I keep on one of my websites (accessed via FTP). One thing I like about KeePass is the Triggers feature which I use to automatically create a backup of the password DB onto my PCs every time I open KeePass. Does Bitwarden have anything like this? I see that you can export your database in Bitwarden, but can it be automated? I just have a fear of having a single copy of the DB, especially if it's in the cloud somewhere.

MurrayM

2502 posts

Uber Geek
+1 received by user: 742

ID Verified

Trusted

Lifetime subscriber

#2648214 5-Feb-2021 14:15

Eva888:

What would happen should one want to change to a different password manager say if the developers went bust or it was removed from the App Store.

They have import/export options that can handle various formats so you should be able to export your logins and import them into another password manager (assuming that their cloud service doesn't suddenly disappear without giving everyone the option to grab their logins, hence my question above about locally stored backups).

michaelmurfy

meow
13580 posts

Uber Geek
+1 received by user: 10911

Moderator

ID Verified

Trusted

Lifetime subscriber

#2648218 5-Feb-2021 14:22

@MurrayM I wouldn't be too concerned about that. They're a bigger company so the cloud side of things should be around for as long as password managers are needed. On top of this, if you're offline your vault can be still accessed from the client and at this point you could always export it to import into another service.

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

MurrayM

2502 posts

Uber Geek
+1 received by user: 742

ID Verified

Trusted

Lifetime subscriber

#2648221 5-Feb-2021 14:28

michaelmurfy:

@MurrayM I wouldn't be too concerned about that. They're a bigger company so the cloud side of things should be around for as long as password managers are needed. On top of this, if you're offline your vault can be still accessed from the client and at this point you could always export it to import into another service.

So it keeps a local copy of the DB on each device? That would make sense and as you say I could export that if I ever needed to.

Looks like I've got a little project for the long weekend!

fearandloathing

537 posts

Ultimate Geek
+1 received by user: 206

ID Verified

Lifetime subscriber

#2648227 5-Feb-2021 14:53

The 'have i been pwned' API is great, I wrote a script that takes all the email address in the exchange tenant and checks them against the 'have i been pwned' API.

@freitasm will you be reevaluating using Yubikeys as an alternative factor for geekzone.

freitasm

BDFL - Memuneh
80653 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2648228 5-Feb-2021 14:54

fearandloathing:

The 'have i been pwned' API is great, I wrote a script that takes all the email address in the exchange tenant and checks them against the 'have i been pwned' API.

@freitasm will you be reevaluating using Yubikeys as an alternative factor for geekzone.

Only if I have time to code around it.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

GregV

932 posts

Ultimate Geek
+1 received by user: 304

#2648236 5-Feb-2021 15:37

fearandloathing:

The 'have i been pwned' API is great, I wrote a script that takes all the email address in the exchange tenant and checks them against the 'have i been pwned' API.

Could you just do a domain search?

1 | 2 | 3 | 4 | 5