Hello everyone, what is your go-to password manager? What would you suggest for friends and family that aren’t very tech savvy?
Hello everyone, what is your go-to password manager? What would you suggest for friends and family that aren’t very tech savvy?
Firefox
Can’t tell if serious.
Give me reasons to not use firefox’s pw manager and I’ll jump back to bitwarden
As a general rule, browser based password storage is less secure than a standalone offering. While convenient, Firefox loads the cipher into memory. and stores passwords in a local file (logins.json) encrypted with 3DES (older versions) or AES (newer), using a key derived from an optional primary password. Without a primary password, Firefox uses a blank key, making it trivially decryptable. Even with one, decryption occurs locally but lacks the layered, zero-knowledge design of something like Bitwarden. This makes Firefox stored passwords more vulnerable to something like a virus outbreak on your computer, which can access your Firefox stored passwords.
This is how I understand it. If someone has better intel, or if I need schooled up, do share.
Even if all the rest were true, what virus outbreak would affect me on Linux?
I am basically relaying conventional wisdom I have gleaned over the years of ‘best practice’. I also forget that a lot of people in the privacy sphere run Linux solely, where as I run Windows, Linux, and Mac. I hold no high ground in privacy, security, or anonymity. You are certainly within spec to run your network as your requirements deem necessary. I’m just a lot more comfortable not using a browser to store my passwords. If you’ve got it all down to a note, then rock on my brother and don’t let them give you shit about your ponytail either.
You seem to be much more knowledgeable on the topic, and while I would call myself privacy conscious, I would hardly consider myself within the pricacy sphere. How would using something like bitwarden or keepassxc work with entering passwords on websites? Firefox just retrieves it from its vault (as bad as it may be from what I’m reading) and then inserts it into the u/p fields. I’ve seen LastPass in action plenty, because corporations seem to love it, and I find it anything but seemless. So how do those two aforementioned compare?