Are password managers really safe?

[stomachmonkey]

Originally Posted by Seahawk

I'll move as well.

And, I know this means I already have issues, but what is 2F?

TIA.

Like Patrick said, it’s a rolling 6 digit code that is sent to your phone via text or you can use an authenticator app which is what i do.

I use Authy, when i need to access one of my accounts you do the user/pass then the site prompts for the code.

Pull up the account from my phone or watch and enter the code which refreshes every 30 seconds.

[Seahawk]

Originally Posted by stomachmonkey

Like Patrick said, it’s a rolling 6 digit code that is sent to your phone via text or you can use an authenticator app which is what i do.

I use Authy, when i need to access one of my accounts you do the user/pass then the site prompts for the code.

Pull up the account from my phone or watch and enter the code which refreshes every 30 seconds.

Thanks. I have got to get more up to speed on this stuff.

[stomachmonkey]

Originally Posted by GH85Carrera

Whatever password manager you use, do your survivors a favor, write down what it is, and how to get into it, and put that in a safe, or big box of financials documents.

My nephew recently died unexpectedly at 34 years old. He has a full business, and the many accounts of a web based guru. His parents still can't get into his phone or many of the accounts. His bitcoins may be lost forever.

Lastpass has a delegate feature.

You assign an individual as your delegate and initially they have no access.

If something happens to you the delegate can request access.

If you do not acknowledge the request within a preset timeframe, 24, 48 hours the delegate is granted access.

[flipper35]

Originally Posted by stomachmonkey

Like Patrick said, it’s a rolling 6 digit code that is sent to your phone via text or you can use an authenticator app which is what i do.

I use Authy, when i need to access one of my accounts you do the user/pass then the site prompts for the code.

Pull up the account from my phone or watch and enter the code which refreshes every 30 seconds.

When you say 2FA, make sure it is a good method. Some methods are easier to hack than the passwords which makes 2FA worthless.

[berettafan]

Pretty sure at every level of technology with computers we've been told 'do this and it will keep you safe'. And thus far at every level of technology with computers that assurance has proven false. I guess now it's 'oh we goofed last time but NOW we have it right!'.

Sure.

[GH85Carrera]

My pet peeve with entering passwords is they all seem to think I have someone looking over my shoulder, so I just see ********* or dot or some useless information. Just show me what I type!

I have no one behind me, around me or near me when I enter the password. And some of them are long and complex for secure sites.

A password manager that fill in the blanks might well be the simplest solution.

[wdfifteen]

Originally Posted by GH85Carrera

My pet peeve with entering passwords is they all seem to think I have someone looking over my shoulder, so I just see ********* or dot or some useless information. Just show me what I type!

+1 on that. It's really frustrating.

[Esel Mann]

Originally Posted by GH85Carrera

My pet peeve with entering passwords is they all seem to think I have someone looking over my shoulder, so I just see ********* or dot or some useless information. Just show me what I type!

I have no one behind me, around me or near me when I enter the password. And some of them are long and complex for secure sites.

A password manager that fill in the blanks might well be the simplest solution.

Shoulder surfers are like the guys with mirrors on their flip flops at the YMCA mens locker room. They are very real. So while the line of '*'s is a pain, it exists for a real reason. There are even folks out there that try to video you typing on your keyboard! That being said, many (not all) have an "eye" icon next to the box where you enter the password to permit you to see it for that one time when the coast is clear.

[flatbutt]

I still use a notebook here at home and since I rarely travel with a laptop I don't need to have it with me outside of the house.

[Esel Mann]

Originally Posted by MMiller

Can you dumb this down for us dummies..?
I assume that's what Mr Mann did but would love further clarity if possible..

So check out KeePassX: https://www.keepassx.org/ this will give you a good idea as to what it is about.
Cliff notes summary: It is a password manager program. It is used to access a file (database) which has all of one's passwords. The file is encrypted. The nicety is the file can be local (as in not up on the cloud) to you. For example, one could have the file on a USB stick. You can even put the password manager program as well on the USB stick. This way it is portable. Which is nice if for example you have a PC at home and say a laptop when you travel. Now the encryption on the file is very good, but only as good as one's choice of master password which is used to access the file.

These programs typically also have for each entry, an area for you to add additional notes. This additional notes feature is a MUST! The reason why is most sites in addition to your password force you to create 3 challenge questions/answers. With the additional notes feature you can (a) store the 3 challenge questions/answers, (b) create answers which are completely unrelated to the question. Said answers make it next to impossible for someone to figure out but also next to impossible to remember unless it is jotted down somewhere.

The mention for an identical second USB stick is simply for back up purposes because if for some reason a USB stick becomes unusable (which does happen) or becomes lost/stolen, the back-up will at least give you the ability to start over.

The mention for Veracrypt (or similar) is to add a second layer of security. Said program is used to encrypt entire USB sticks or even hard drives. That way if the USB stick is lost/stolen, it will be more difficult to get at whatever is on the USB stick. Like the password manager program a single master password is used to access the encrypted USB stick. So protection is only as good as one's choice of master password.

[GH85Carrera]

Originally Posted by Esel Mann

So check out KeePassX: https://www.keepassx.org/ this will give you a good idea as to what it is about.
Cliff notes summary: It is a password manager program. It is used to access a file (database) which has all of one's passwords. The file is encrypted. The nicety is the file can be local (as in not up on the cloud) to you. For example, one could have the file on a USB stick. You can even put the password manager program as well on the USB stick. This way it is portable. Which is nice if for example you have a PC at home and say a laptop when you travel. Now the encryption on the file is very good, but only as good as one's choice of master password which is used to access the file.

These programs typically also have for each entry, an area for you to add additional notes. This additional notes feature is a MUST! The reason why is most sites in addition to your password force you to create 3 challenge questions/answers. With the additional notes feature you can (a) store the 3 challenge questions/answers, (b) create answers which are completely unrelated to the question. Said answers make it next to impossible for someone to figure out but also next to impossible to remember unless it is jotted down somewhere.

The mention for an identical second USB stick is simply for back up purposes because if for some reason a USB stick becomes unusable (which does happen) or becomes lost/stolen, the back-up will at least give you the ability to start over.

The mention for Veracrypt (or similar) is to add a second layer of security. Said program is used to encrypt entire USB sticks or even hard drives. That way if the USB stick is lost/stolen, it will be more difficult to get at whatever is on the USB stick. Like the password manager program a single master password is used to access the encrypted USB stick. So protection is only as good as one's choice of master password.

Thanks for that!

I have one more question. What is I need to access my passwords to use on with my iPhone?

[Esel Mann]

Are you asking what applestore downloadable app to use with an iphone that is a password manager program?

If so, take a look see at https://keepassium.com/

Cursory look it appears to be KeepassXish but for iphones/tablets.