Password Managers - what's worth trying?

Forums › Desktop computing › Password Managers - what's worth trying?

citrofia

10 posts

Wannabe Geek

# 209101 12-Mar-2017 22:45

Amongst my list of 'things I probably should have done 2 years ago' is insitgating a password storage/management system for my home and work related needs.

I'm mainly using Windows and android devices, with my wife on iOS and Mac for her photography stuff. Work is basically Windows with no requirement for multi-user at the moment.

I've had a browse and there's a bit of talk about Lastpass (mixed opinions) and 1password for Mac.

I guess for me something that is straightforward and easy to use is probably more important than a massive feature set.

What are people using? Are there definite must-avoids?

Thanks

1 | 2 | 3

16 posts

Geek

# 1735465 12-Mar-2017 23:11

One person supports this post

Hi,

I use Padlock

https://padlock.io/

It does all I require.

I like the interface.

The only down side is no portable version, I tried to make one but it didn't work.

There's versions for windows, mac, android, ios and chrome, I've only used the windows version.

https://padlock.io/downloads/

michaelmurfy

/dev/null
9029 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 1735469 12-Mar-2017 23:27

6 people support this post

I use Lastpass Premium and it is very good. The Android client is also quite good. I did test 1password and while it has a clean interface etc I didn't think it was as polished as Lastpass (when I tried it anyway).

Pros:
1) Chrome integration.
2) Totally cross-platform.
3) Works well with Android.
4) Supports 2FA.
5) Automatic - it'll ask to log you in to some sites.

Cons:
1) Android app can sometimes get in the way.
2) The Chrome app can sometimes mess with some web forms or fail to save a generated password - I believe this has been fixed in a recent update.

jarledb

Webhead
2391 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 1735470 12-Mar-2017 23:29

One person supports this post

1Password works for Mac, Windows, Android and iOS and you can setup sharing of vaults (so selected sites/passwords) between accounts.

Works across various browsers and also lets you store credit card information, other passwords, secure notes etc.

Would recommend you give it a try, think it could be a good solution for your needs.

djtOtago

569 posts

Ultimate Geek

Subscriber

# 1735472 12-Mar-2017 23:36

2 people support this post

+1 Lastpass

fizzychicken

286 posts

Ultimate Geek

# 1735473 12-Mar-2017 23:44

2 people support this post

I use last pass premium and yubi key neo, works great at work and home for windows and great on android devices (with NFC for yubi key). on android I use it to copy and paste the login details as Im not a fan of the overlay app, but it does all I need to. Works fine on the Ipad as it is set to not ask for the yubikey (only because of no usb/nfc).

https://keybase.io/fizzychicken

ANglEAUT

1074 posts

Uber Geek

Trusted

# 1735476 13-Mar-2017 00:17

One person supports this post

@critofia: ... there's a bit of talk about Lastpass (mixed opinions) ...

LastPass is OK. The auto login feature on site like the home router make life a lot easier. I use that on my Unify controller when looking at my daily stats. It also has very good options for the password complexity. See here: https://lastpass.com/generatepassword.php. The browser extension options are the same.

It can be problematic with sites where you have multiple user accounts. I don't know if this is a problem with LastPass or the website owner not implementing correct/useful user name & password fields.

Every now then it generates a password and saves the incorrect field on the form which results in a lost password.

I've heard others complain that using it on a mobile device is cumbersome. I have no experience with that.

WRT sharing. The free version only allows sharing of individual items, the premium version allows sharing of a folder of several items simultaneously.

Edit: Added sharing info.

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

fizzychicken

286 posts

Ultimate Geek

# 1735477 13-Mar-2017 00:35

2 people support this post

I've had the same multi-login issue. I have some services for which I have a work login and a personal 'home' login etc. I've just learnt over time that whenever that top right pop-up of 'should we update that stored psassword for you?' comes up, I always hit no if I know there is an alternative login for that site. I ensure i 'copy' generated passwords to the clipboard and save them in the lastpass vault manually if I already have a login for that site. Sometimes the default details created in the vault remember the sign up url and not the login url, but it is pretty smart at figuring it out based on domain. So far only battlenet has been the exception for me as it doesnt allow the use of paste in a password field and doesnt seem to like the extension. I have about 60 different login credentials stored in my vault. Any related to financial (online banking) I keep in my head. I like the security check in lastpass where I can analyse the age and complexity of all of my passwords. The automated password changing, on supported sites, is fantastic.

And always, where ever I can, I use 2fa, either the yubi key or an authenticator (google,rsa etc.) or sms, or sometimes all of them.

some light password fun readings...

https://www.usenix.org/system/files/1401_08-12_mickens.pdf

goo.gl/H0exaG

edited for link

https://keybase.io/fizzychicken

Jedsdad

120 posts

Master Geek

# 1735495 13-Mar-2017 04:40

One person supports this post

Password Safe

https://pwsafe.org/

It does the job for me and I like the layout

timmmay

15564 posts

Uber Geek

Trusted

Subscriber

# 1735502 13-Mar-2017 07:03

13 people support this post

KeePass2. Open source, clients available for Windows, Android, and probably other platforms. I put the encrypted database on Dropbox and use it on all my computers and devices. Simple and effective, I think it has browser integration but I prefer copy and paste, more difficult to compromise.

Hammerer

2099 posts

Uber Geek

Lifetime subscriber

# 1735507 13-Mar-2017 07:28

One person supports this post

I have what timmay has.

KeePass2. Open source, clients available for Windows, Android, and other platforms. I put the encrypted database on OneDrive and use it on all my computers and devices. Simple and effective, it has browser integration but I prefer copy and paste although that has its own risk e.g. if clipboard is kept open.

I have always refused to use Lastpass because of potential risks which over time have turned into actual security failures.

The legacy version, which doesn't require .NET, passed a recent EU security audit:

https://www.ghacks.net/2016/11/22/keepass-audit-no-critical-security-vulnerabilities-found/

P.S. There are a lot of reviews and comparisons that are useful if you are trying to decide:

https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/

Although the reviewers often show their own preferences so they get the finer details wrong. For example, the reviewer in the above article says of Keepass database sharing using Dropbox and similar online services:

Of course, at that point, you’re putting your passwords back in the cloud, which invalidates KeePass’ biggest advantage, but it’s there if you want it.

The point is not just that it is available online, it is that the target Lastpass interface for hackers is a very public and easily identified URL which Keepass doesn't have.

jonherries

1091 posts

Uber Geek

Subscriber

# 1735509 13-Mar-2017 07:43

jarledb:
1Password works for Mac, Windows, Android and iOS and you can setup sharing of vaults (so selected sites/passwords) between accounts.

Works across various browsers and also lets you store credit card information, other passwords, secure notes etc.

Would recommend you give it a try, think it could be a good solution for your needs.

Best thing for 1password is watchtower, the AgileBits team trawls the news for vulnerability reporting and recommends updating passwords in your vault on this basis. 1passwrd can also do this based on age, and password strength.

They had a blog post up about the latest cloudflare vulnerability within a couple of hours, confirming that their software (and therefore your vault) remained secure, and have since been identfying potentially vulnerable passwords.

Jon

Coil

6615 posts

Uber Geek
Inactive user

# 1735511 13-Mar-2017 07:53

Jedsdad:

Password Safe

https://pwsafe.org/

It does the job for me and I like the layout

Super simple and pretty sure you can bind keys to it as well.
Does the job without any extras that you dont need.

mugs2000

61 posts

Master Geek

# 1735532 13-Mar-2017 08:55

I've been using Password gorilla for years without problems with windows and linux. It also works with Mac, and I believe Android as well. Works across multiple devices using a dropbox encrypted folder as well as its native encryption.