Octopus Overlords

I did a search and the most recent thread is about 2 years old. So what are people using these days? I need something that work with Android.

Also, how would something like this work on a Roku device? Would I just have to bite the bullet and enter the crazy passwords by hand?

KeePass 2.x because it's open-source and one of the best-known and most widely trusted Password Managers around. I also prefer being able to keep track of my passphrases myself rather than using a cloud service that relies on the integrity of a company to maintain my privacy (at least while the company remains in business). The wide variety of available KeePass Plugins are also mighty handy. For example, the Readable Passphrase Generator allows you to generate passphrases that are (mostly) grammatically correct but completely random and nonsensical, as famously illustrated by XKCD:



So they're easier to enter (for humans) yet highly secure and difficult to guess (for humans and computers). Which helps simplify the process of entering a passphrase on your Roku, for example.

I've only used LastPass. It works fine on Android and Windows (the platforms that I have). Don't believe it'd work on a Roku. Isn't the ONLY way you'd get anything entered into Roku is play with the remote? Does that thing even take a Keyboard? Mine doesn't.

2nd KeePass, but can't say anything about Roku

stessier wrote: ↑Sat Jan 25, 2020 8:41 pm

Also, how would something like this work on a Roku device? Would I just have to bite the bullet and enter the crazy passwords by hand?

I've noticed that services are starting to use authentication. You log in via phone/of and enter the code that comes up on your device (Roku, Firestick, etc). No password required.

No idea if this happens on Roku.

Yeah, we got a new Roku a couple of months ago, and I think that's how it authenticated.

And a 2nd for LastPass.

Either of the two is good. Just look at the differences and go from there.

Thanks, gives me a place to start.

KeePass doesn't sync, so you need a different way to sync passwords across multiple devices (like DropBox or similar). Lastpass supports more authentication methods like Authenticator (its own, Google's, Authy, or even a hardware device like Yubikey) but LastPass costs money.

Kasey Chang wrote: ↑Mon Jan 27, 2020 2:21 pm KeePass doesn't sync

Incorrect.

KeePass 2.x includes built-in support for Synchronization and KeePass Plugins make it pretty much effortless to use with the vast majority of cloud storage providers such as Dropbox and the like (e.g. KeeAnywhere).

FWIW, BitWarden is another free, open-source end-to-end encrypted Password Manager that makes for a worthy alternative to LastPass.

Should have said it didn't used to sync, and it has no built-in sync METHOD (though it's sync mechanism agnostic)

Kasey Chang wrote: ↑Mon Jan 27, 2020 2:21 pm KeePass doesn't sync, so you need a different way to sync passwords across multiple devices (like DropBox or similar). Lastpass supports more authentication methods like Authenticator (its own, Google's, Authy, or even a hardware device like Yubikey) but LastPass costs money.

I use LastPass on my laptop, three desktops, my tablet, and my phone. I have never paid a dime.

I use and am happy with LastPass. I do pay to enjoy some benefits I am no doubt NOT using. Maybe that helps keep it free for others...

Blackhawk wrote: ↑Mon Jan 27, 2020 7:23 pm I use LastPass on my laptop, three desktops, my tablet, and my phone. I have never paid a dime.

The official word on what's the difference between free plan and paid plan(s)

https://www.lastpass.com/plans

we use Dashlane @ work / home. I like it!

Kasey Chang wrote: ↑Mon Jan 27, 2020 10:01 pm

Blackhawk wrote: ↑Mon Jan 27, 2020 7:23 pm I use LastPass on my laptop, three desktops, my tablet, and my phone. I have never paid a dime.

The official word on what's the difference between free plan and paid plan(s)

https://www.lastpass.com/plans

Yep. None of it is anything that I have any real use for, and I doubt most typical users that don't need it at some professional level would, either.

Work has been using Keeper for a while, and it works pretty well. Vaults are web-accessible, so until they have the inevitable breach, syncing is not an issue.

Oh, and the website is keepersecurity.com, not keeper.com.

I bought into a premium LastPass subscription a couple of years ago. Works on multiple computers, Android, iPad, etc. I can share passwords, either open or hidden, with family members so they aren't always asking me the Netflix password.
Not long after joining, my work implemented LastPass for our CIP assets. My corporate account and personal account linked up with no hassle.
The security checkup let's you know where you have weak, compromised, or repeat passwords.

I consider it money well spent. I am running into a few sites that don't allow you to paste into their password field. Sometimes only in the register page, but sometimes in the login screen. I always make it a point to gripe to their feedback address.

Is there a password manager that lets you select what rules you need followed when a new password is generated for you? (Like: "at least one number", "at least one symbol but but not ^*./()[]!", etc.)

I've been pretty happy with Codebook but that's a feature I really wish it had.

LastPass does that.

Things you can set:
Password length
Easy to say
Easy to read
All characters
Uppercase
Lowercase
Numbers
Symbols

Welp, LastPass's free option is no longer viable. Received this morning:



In addition, they're revoking email support for free users and limiting them to their forums. Buh-bye.

Time to find their replacement.

I'm leaning toward Bitwarden. The free option is just as good, the paid option is 1/4 the price of LastPass's, they have a good reputation, they support import of LastPass data, and they are plug-and-play (no elaborate processes, no third party apps to sync, etc.)

Oh, and they aren't greedy shits.

Blackhawk wrote: ↑Tue Feb 16, 2021 10:30 am I'm leaning toward Bitwarden. The free option is just as good, the paid option is 1/4 the price of LastPass's, they have a good reputation, they support import of LastPass data, and they are plug-and-play (no elaborate processes, no third party apps to sync, etc.)

Oh, and they aren't greedy shits.

Indeed, and more importantly from a security perspective, Bitwarden is FOSS (Free & Open Source Software). Trusting closed source proprietary software/developers makes it much more difficult to verify what security measures they are using, verify that they are being implemented correctly, and verify that they are properly monitoring for intrusions, etc.

FWIW, here's a useful video guide that walks through setting up and configuring Bitwarden:

Thanks. I'm going to dive into changing PCs, tablets, and phones later this afternoon. I'll give that a watch first.

I've been thinking about dumping LastPass for a couple of months anyway. Their android support has gotten worse and worse, to the point that it has been essentially non-functional lately.

Just from reading some of the comments from one of the articles that posted this, it seems quite a few people on the free version were already shopping around anyway (including myself).

I had the paid version of LastPass for a few yeas, then didn't see the benefit so switched to free in the past couple (after losing my job, also!). I have no hard feelings about this at all - their iOS app and desktop browser integration worked almost flawlessly for me for many years, and I don't begrudge them trying to make money.

OTOH, these days I am a bit more paranoid than I used to be as a young buck, and it's FOSS all the way for me, whenever possible and convenient (or at a sw transition, like this).

The fact that I have SOOOO freaking many passwords and secure notes (I use it as our family vault, with ALL our info (SS#'s, bank info, etc). Not just usernames and passwords.

Bitwarden it is, unless someone wants to sell me on something better. The LastPass import feature is a requirement in my case.

Here's the link for how to export from LP to Bitwarden if anyone needs it:

https://bitwarden.com/help/article/impo ... -lastpass/

FWIW, Wirecutter recommends 1Password, and Bitwarden is the "budget pick":
https://www.nytimes.com/wirecutter/revi ... -managers/

Most Web browsers already offer to save and auto-fill your passwords for you, and browsers such as Chrome and Safari even offer to generate strong passwords when you need them. Using Google Smart Lock or Apple's Keychain is certainly better than reusing weak passwords. But password managers go above and beyond—a good one alerts you to weak and reused passwords, lets you know when you should change a password because a service you use has been hacked, and allows for the sharing of passwords and other information between family members and friends.

i use Firefox Lockwise - i don't have a problem with making weak/reused passwords, it does tell me if a service has been hacked, i don't need to share passwords with anyone, and it shares my account info between Firefox browsers on any number of devices. is there still any reason i should be using a standalone password manager instead?

hitbyambulance wrote: ↑Tue Feb 16, 2021 2:43 pm

Most Web browsers already offer to save and auto-fill your passwords for you, and browsers such as Chrome and Safari even offer to generate strong passwords when you need them. Using Google Smart Lock or Apple's Keychain is certainly better than reusing weak passwords. But password managers go above and beyond—a good one alerts you to weak and reused passwords, lets you know when you should change a password because a service you use has been hacked, and allows for the sharing of passwords and other information between family members and friends.

i use Firefox Lockwise - i don't have a problem with making weak/reused passwords, it does tell me if a service has been hacked, i don't need to share passwords with anyone, and it shares my account info between Firefox browsers on any number of devices. is there still any reason i should be using a standalone password manager instead?

Perhaps. While I can certainly understand the convenience of tying every log-in and passphrase you use to a particular web browser, doing so would still rub me the wrong way. Also, from what I've read about Lockwise, it tends to lack features that are ordinarily provided by most dedicated, full-featured secure passphrase managers (such as full passphrase customization, so that you're able to fully customize generated passphrases by choosing specific lengths, allowing or disallowing numbers and symbols, and so forth).

The following ZDNet write-up covers the subject in more detail:

Password managers: Is it OK to use your browser’s built-in password management tools?

I'm vested in Lastpass, but I'll probably shift to Bitwarden. I need to have it on devices and if I'm going to pay, it may as well be for the best one.

Jag wrote: ↑Tue Feb 16, 2021 4:18 pm I'm vested in Lastpass, but I'll probably shift to Bitwarden. I need to have it on devices and if I'm going to pay, it may as well be for the best one.

If you're going to pay, why not just stay with LastPass? It's not like it's a bad choice (if you pay, obviously).

Carpet_pissr wrote: ↑Tue Feb 16, 2021 5:02 pm

Jag wrote: ↑Tue Feb 16, 2021 4:18 pm I'm vested in Lastpass, but I'll probably shift to Bitwarden. I need to have it on devices and if I'm going to pay, it may as well be for the best one.

If you're going to pay, why not just stay with LastPass? It's not like it's a bad choice (if you pay, obviously).

Bitwarden is significantly cheaper at the individual level ($10/year vs $40) and slightly cheaper for a family plan ($40 vs $48).

I briefly had the same thought, but I feel like the way they decided to monetize felt really sleazy (they didn't monetize by adding features or convenience, or even by moving a few features. They essentially broke the functionality of the free version and gave the freeloaders 30 days to get out.) I get the need to monetize, but this isn't convincing us to upgrade. Instead, it felt hostile and unfriendly. I'm not going to reward that.

Thank you guys for doing my homework for me. Bitwarden it is.

Carpet_pissr wrote: ↑Tue Feb 16, 2021 5:02 pm

Jag wrote: ↑Tue Feb 16, 2021 4:18 pm I'm vested in Lastpass, but I'll probably shift to Bitwarden. I need to have it on devices and if I'm going to pay, it may as well be for the best one.

If you're going to pay, why not just stay with LastPass? It's not like it's a bad choice (if you pay, obviously).

I've been paying for LastPass for several years and have been happy with it. I will likely just upgrade mine to a family plan (I believe that is doable, haven't researched it yet) to cover the wife and my mother who have been on the free tier. That is way easier than moving everybody over and re-training!

Anonymous Bosch wrote: ↑Tue Feb 16, 2021 3:51 pm
The following ZDNet write-up covers the subject in more detail:

Password managers: Is it OK to use your browser’s built-in password management tools?

Huh, for Firefox Lockwise, I'm not sure if he's speaking about the mobile version, but the desktop version has never required needing a Firefox account to save passwords. The writeup uses confusing language.

stessier wrote:

Carpet_pissr wrote: ↑Tue Feb 16, 2021 5:02 pm

Jag wrote: ↑Tue Feb 16, 2021 4:18 pm I'm vested in Lastpass, but I'll probably shift to Bitwarden. I need to have it on devices and if I'm going to pay, it may as well be for the best one.

If you're going to pay, why not just stay with LastPass? It's not like it's a bad choice (if you pay, obviously).

Bitwarden is significantly cheaper at the individual level ($10/year vs $40) and slightly cheaper for a family plan ($40 vs $48).

FWIW just got this email from LastPass:

“Leading up to these changes, you can upgrade to Premium at a limited-time discounted rate of $2.25 per month, billed annually ($27 /year).”

That’s for a year. $36 is normal price after that.

Well I’m shocked at how painless that transition was.

One of the reasons I never switched or even tried anything other than LastPass was due to assuming it would be a huge pain.

Nope! Took all of 10m to import everything. I’m also shocked at how similar the two programs are (at least in terms of the browser extensions).

I assume there are major differences underneath the UI, but was not expecting them to look and work pretty much identically.

That's encouraging. I talked big, but put it off myself due to not wanting to deal with every PC, laptop, tablet, and phone in the house.

I signed the family up for Bitwarden. I'm the guinea pig during the free trial period. I find it is hit or miss on apps on my Pixel 2, but I really need to try more to make sure I'm doing it right. Some web pages it also has trouble recognizing I'm entering user/pass info and I have to go in and create my own card. Again, probably user error, but it's not clear what I'm doing wrong either. Still have 5 days left in the free trial - likely will keep it, just wish I could find more time to play with it.

stessier wrote:I signed the family up for Bitwarden. I'm the guinea pig during the free trial period. I find it is hit or miss on apps on my Pixel 2, but I really need to try more to make sure I'm doing it right. Some web pages it also has trouble recognizing I'm entering user/pass info and I have to go in and create my own card. Again, probably user error, but it's not clear what I'm doing wrong either. Still have 5 days left in the free trial - likely will keep it, just wish I could find more time to play with it.

Did you import from another program?

Carpet_pissr wrote: ↑Wed Feb 24, 2021 3:56 pm

stessier wrote:I signed the family up for Bitwarden. I'm the guinea pig during the free trial period. I find it is hit or miss on apps on my Pixel 2, but I really need to try more to make sure I'm doing it right. Some web pages it also has trouble recognizing I'm entering user/pass info and I have to go in and create my own card. Again, probably user error, but it's not clear what I'm doing wrong either. Still have 5 days left in the free trial - likely will keep it, just wish I could find more time to play with it.

Did you import from another program?

Nope, I used a rolodex before this (low tech, but quite effective).