momijizukamori: Grey tabby cat with paws on keyboard and mouse. The text reads 'code cat is on the job', lolcats-style (CODE CAT)
Cocoa ([personal profile] momijizukamori) wrote in [site community profile] dw_news 2023-01-22 12:02 am (UTC)

Password Managers

My day job is in appsec, and we've actually had some conversations about password managers lately, given the LastPass mess, so I figured I'd share some of the results!

1) If you are a Safari user, and not likely to be a specific target (because you work in highly classified areas or whatever), I have been told the built-in Safari password manager in newer versions is sufficiently secure - it uses the Apple keychain credential storage system and does not store passwords in plaintext.

2) If you want the best UI and don't mind a paid service, 1Password. Also can handle stuff like 2FA (please use an authenticator app whenever possible, text message codes for authentication are really vulnerable)

3) If you want a good-enough UI and a decent free plan, BitWarden. For the slightly more paranoid, you can also run your own copy of the sync server instead of using their cloud storage (which is where LastPass got compromised). It's also open source.

4) For people who want to avoid other people's cloud services entirely and don't mind some UI friction, KeePassXC is open source and you have to handle syncing yourself (however, if you're the sort of person who would pick KeePassXC over Bitwarden I suspect you are already using it, heh).

Post a comment in response:

This account has disabled anonymous posting.
(will be screened)
(will be screened)
If you don't have an account you can create one now.
HTML doesn't work in the subject.
More info about formatting

If you are unable to use this captcha for any reason, please contact us by email at support@dreamwidth.org