Best password manager?

[NeverDie]

As a follow-up to my other thread about improving overall security: what do people here recommend for password management? A cloud service like LastPass or similar? A self-hosted password manager? Something else? What exactly?

Not sure if it relates to this or not, but I'm pretty keen to get a yubicon for 2FA on critical internet accounts, like email and banks. Maybe even amazon and ebay. Well, heck, why not everything, including mysensors.org? According to my chrome browser, openhardware.io was hacked and passwords revealed. So, yes, I did change my password for openhardware.io, but remembering the new, more secure password isn't easy. I suppose home network security might also benefit from 2FA, but AFAIK it's really "in addition to" rather than "instead of" a password manager for remembering long, randomly generated keys.

I read somewhere that the average person these days has around 85 passwords they need to remember. That seems like a high number to me, but whatever it is, it's definitely far greater than 7 plus or minus 2. And if you have a unique password for every device and virtual machine on your network, the numbers get big in a hurry, let alone the need to keep track of it all and rapidly access the passwords when needed.

[mfalkvidd]

@NeverDie 85? I have 1458.

I like LastPass. I use Keepass occasionally. I recently heard about Bitwarden which looks good but I have not used it yet.

[BearWithBeard]

Almost 1.5k passwords? That's crazy! I guess I'm slightly above average with my 99 passwords.

LastPass? Haven't they been hacked multiple times? Their browser addons leaked passwords, too. They also seem(ed) to (have) expose(d) potentially sensitive data in clear text when you stored a website.

KeePass is my preferred password manager. It's free, open source, recommended by a couple of European IT / security authorities, has been audited at least twice, and most importantly:

It doesn't require any accounts, cloud or internet connection whatsoever. Your stuff is stored locally in an encrypted database. The downside is that KeePass is most likely not as "easy" or user friendly to use as LastPass. You have to take care of syncing your database across devices yourself, e.g. by using a self hosted NextCloud or with triggers.

KeePass is natively available on all desktops, there are ports for smartphones and many plugins for different use cases - private key management, QR codes, backup and sync, ...

[skywatch]

FWIW I tend to agree - I have been using KeePass on win 10 laptop for years and for android I use Bitwarden. They both work as expected and are simple to install and set up . KeePass has an add-on for Firefox as well which makes things even easier.

[alexelite]

@mfalkvidd said in Best password manager?:

Bitwarden

Bitwarden self hosted works very well for me. Definitely a strong candidate for best password manager.

[Puneit Thukral]

I moved from keepass to Bitwarden self hosted. For a while I used both in parallel and now I have fully moved to Bitwarden self hosted. It integrates very well with everything- iOS, Safari on Mac and other browsers

[NeverDie]

@BearWithBeard said in Best password manager?:

Haven't they been hacked multiple times?

As I understand it, as long as your master password is both unique and strong enough, it shouldn't matter if LastPass or similar were hacked, since it's a hash of your password that gets stored, not the password itself. On the other hand, if you had a weak master password, then an attacker could probably crack it from knowing the hash, and, at that point, you might well be in serious trouble.

I only just learned that Google chrome allegedly uses your Microsoft Windows 10 password to secure your chrome passwords. Well, a lot of people (like my wife) don't even have a Windows 10 password, to make logging in faster and easier when powering up the computer. So, in their case, I wonder if Chrome, which has nicely collected their passwords, offers any protection at all. Anyhow, now that I know, I need to fix this, in some way or another, even though my wife won't like the inconvenience.

[mfalkvidd]

@NeverDie all password managers store the real passwords. Password hashes would be of no use. But they store the passwords encrypted.

[BearWithBeard]

@NeverDie Yes, LastPass vaults may have been secure as long as the master password couldn't be cracked, but it could have been worse, too. And who knows if (or when) they will be hacked again.

Maybe I'm too paranoid here, but I think data stored in someone else's public network is inherently insecure. You have to trust that a company protects some of your most valuable data, that they are not deceiving you with false promises and that their security engineers are more skilled than the black hats.

Remember the Ubiquiti hack recently? Attackers gained access to customers' cloud managed devices, by gaining root access to Ubiquiti's AWS cloud instances and S3 buckets via credentials stored in an IT employee's LastPass cloud account. What could happen if a key LastPass employee becomes a victim of a social engineering attack? Do they really have no master key or other way of decryption? With upwards of 25 million users storing their login credentials, LastPass is an attractive target for hackers.

Sure, a cloud-based password manager is still much safer than using the same password everywhere. The question is, where are your passwords more secure? In the hands of a company that can hire highly skilled security experts to protect the data of millions publicly, or in our own incompetent hands, stored locally, below the radar level of hackers and where nobody other than us has access to - well, unless we are directly targeted of course. Both ways have their own set of risks.

I personally prefer self-hosted, local or offline solutions over anything cloud- or account-coupled wherever that's an option.

Bitwarden has been mentioned a few times now. Apparently it can be self-hosted, too. Guess I should have a look at it sometime!

[NeverDie]

I keep thinking about the special chip used in the circuit design of a proper mysensors wireless sensor that securely holds the wireless password keys for connecting with the mysensors gateway. As I understand it, even if the mysensors node fell into the hands of a bad guy, the bad guy wouldn't be able to extract the password. In this way, your mysensors network remains secure.

I've forgotten he particulars, but that's roughly the gist of it, isn't it? Yet the mysensor node's software is able to make use of that hidden password anyway, right?

So, barring any major conceptual disconects, I would think that there could exist something analogous for holding passwords to websites, where by design it's simply impossible for the actual secret password to be leaked or otherwise discovered.

Could it actually work like that? Or, am I misrepresenting the facts, or oversimplifying, or otherwise glossing over too many important details?

[mfalkvidd]

@NeverDie it can't work unless websites change from password login to something else. There are very many such attempts*, but the majority of sites still use password login because it is easy to implement, works with no additional code or hardware, and people are used to it.

• examples: sqrl, fido

[NeverDie]

@BearWithBeard said in Best password manager?:

Bitwarden has been mentioned a few times now. Apparently it can be self-hosted, too. Guess I should have a look at it sometime!

I notice there's some banter on youtube about using Bitwarden in conjunction with two factor authentication.

I just today ordered a couple of different 2FA key fobs to see if maybe either one holds any promise:

https://www.amazon.com/gp/product/B0821TDLP4/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&psc=1

and

https://www.amazon.com/gp/product/B06Y1CSRZX/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&psc=1

In addition to 2FA, these fobs allude to things like one time passwords, and perhaps even becoming "passwordless." Although both are essentially just a shot in the dark for me, one has to start somewhere. If anyone here is further along in this and has any particular favorites, I'd be very interested to hear which devices you currently like the most.

[mfalkvidd]

@NeverDie I have a few Yubikeys. They are the first such devices I heard about that aren't tied to a specific service (ebay and paypal had their own fobs but they only worked on their respective services). I bought my first in 2007.

Some models have support for nfc, so they work with a phone.
They support U2F which probably will be the basis for webauthn

You can also build your own U2F device: https://github.com/conorpp/u2f-zero which has been replaced by https://github.com/solokeys/solo
I tried to build one a few years ago, but my SMT solderings skills were not good enough.

[NeverDie]

@BearWithBeard said in Best password manager?:

I personally prefer self-hosted, local or offline solutions over anything cloud- or account-coupled wherever that's an option.

Yeah, I think I share this preference. The only advantages I can think of for storing a password vault in the cloud are:

1. Presumably, it's backed up often and regularly by whichever vendor you pick.
2. Perhaps it's easier to share keys across different, distant platforms. In my case, I don't forsee much need for this.
3. If it perhaps comes with very good software and extensions/integrations that makes it more convenient and/or easier to use (especially for a spouse or son/daughter to use) than alternatives. I don't see anything that inherently requires a cloud for that, but competition among password companies and the money they rake in obviously helps in getting it built and maintained, let alone well documented and supported.

On the other hand, I think for local network passwords, of which there can be many, there's an obvious advantage to not depending on the cloud for password management, since you will still want access even if your internet connection goes down. So, based on the helpful feedback here (thanks everyone!), I'll probably look into Bitwarden also.

I have no evidence for it, but given the choice, I think I'd rather have the password vault stored in some kind of specialized security chips that were cleverly designed for that purpose. Somehow, anything on a general purpose computer just seems inherently more vulnerable, even if it's on a local network rather than on a cloud computer. So, if there's any truth to that, I imagine there are already specialized devices on the market which cater to that. At this point I just need to learn enough so that I at least become aware of what the essential features are to look for.

Anyhow, I could imagine that in the end I may (probably) end up with two separate, non-overlapping methods for "access management" (for lack of a better term). The first would be for those websites or network devices that are of the more primitive, password-oriented type (as described by @mfalkvidd t above), because if that's what they use exclusively, there's just no getting around it. The second would be a method better suited for devices/websites that can be accessed using more sophisticated, non-exclusively password methods that are just better and much more secure than resorting to passwords. In this way, one uses the best of what's available, and it should still be manageable because there are just two schemes to consider.

And I would "turn on" 2FA and use it whenever possible. I'm finding that in many instances it is already supported as an option for banks, brokerages, email, even if it's not currently required. Though not a secret, most often its existence is poorly advertised. However, now that I'm looking for it, I'm finding that a lot of sites have it.

[mfalkvidd]

@NeverDie you mean there exists banks that don't require a second factor to login? My bank has required 2fa since I started using their web services in 1997.

[NeverDie]

@mfalkvidd Well, now that you mention it, I think the ones here do seem to require 2FA (usually typing in a number that they text to your telephone) if you try to log in with a new, "untrusted" device. But after doing it once, if you later use the same device (say, a PC or phone), then I guess the 2FA, if it still qualifies as that, is based on only just your password plus some kind of persistent cookie that they leave in your device cache. If you clear the cache, it suddenly thinks it's a new untrusted device, and then it's back to square one.

Anyhow, what I meant wasn't that, but rather the ability to use a yubicon type device. Is there specific terminology that would separate the older 2FA (e.g. text to your phone) from the new fancier way?

The devices from Amazon (linked above) that I ordered arrived a few minutes ago, so I hope to be giving them a test drive sometime soon.

This guy shows how to, for example, set up a linux server so that you can log-in using only just public and private keys:
5 Steps to Secure Linux (protect from hackers) – 23:15
— NetworkChuck

In fact, he completely disables regular password logins. On first glance it does looks intriguing, maybe even promising. But is it ultimately any better than just using a sufficiently strong password in the first place? That's the key question. He strongly implies that his method is more secure, but he presents no proof of that. Is it blindingly obvious? Well, not to me. And if it's more secure, is it just marginally more secure or is it a lot more secure--enough so to easily justify the effort and inconvenience of doing it? I'd certainly like to know. I would guess that since it's fairly simple it has been widely studied, and that there are reasoned assessments of it, and maybe even some empirical data as to how hack resistant it is in practice. Is there a commonly used name for his technique? If I knew at least that much, it would be a lot easier to check the literature.

[mfalkvidd]

I'm not prioritizing to look at the whole video, and the link to the list of commands used requires a login, but ecc ssh keys can be compared to a randomly generated password of 27 lower case characters, or a randomly generated password with 21 alphanumeric characters in lower and upper case.

To brute force such a password (or the comparable key) by trying 1,000 logins per second (which assumes your server doesn't use sshguard which would lock out such attempts) would take about 50 trillion trillion centuries on average.

I use ssh keys daily. Not really because the are more secure, but because they are more convenient. As long as you use sufficiently long passwords, password login is as secure as key login. If you use shorter passwords, ssh keys will give better protection.

Here is a guide to use a Yubikey for ssh login: https://developers.yubico.com/yubico-pam/YubiKey_and_SSH_via_PAM.html I used it myself on a test server back in 2007, but I have not used it after that.

[NeverDie]

Reporting Back: I'm not liking the OnlyKey. I have to enter a 7 - 10 digit password on it to activate and make use of it. And the buttons are just tiny touch sensors, with no tactile feedback. More to the point: In a home environment I don't feel that I need that type of physical security on a 2FA device. So, in retrospect, maybe a Yubico would have been a better choice. I could be wrong, but I don't get the impression that a yubikey has to be manually unlocked every time before using it.

I'll try the Thetis next.

[NeverDie]

As near as I can tell, the Yubikey 5C is the most capable, in that it can do the most things:

MULTI-PROTOCOL SUPPORT: The YubiKey USB authenticator has multi-protocol support including FIDO2, FIDO U2F, Yubico OTP, OATH-TOTP, OATH-HOTP, Smart card (PIV), OpenPGP, and Challenge-Response capability to give you strong hardware-based authentication.

So, I ordered one of those to take for a test drive. Anyone here curious about anything that you would like me to try with it and report back?

Allegedly Google distributed these types of keys to all 85,000 of its employees years ago and didn't have any account takeovers ever since. So, in at least an empirical sense, they seem to be highly effective as authenticators.

[Sasquatch]

+1 to keepass, store your database on Google drive/Dropbox/nextcloud and secure it with password+ yubikey and you have bulletproof solution. Just remember to have clone youbikey in a safe.
Keepassxc on windows/Linux, keepas2android and keepasium on Android and iPhone respectively.

@mfalkvidd ever heard of hardware keyloggers? You can buy ones that log every keystroke on any wireless keyboard(wired too).

That's why I'm using yibikey and keepass. Even if my master pass leaks out it's useless without youbikey. And stolen/lost yubikey without pass is just a piece of plastic.

[NeverDie]

@Sasquatch said in Best password manager?:

ever heard of hardware keyloggers? You can buy ones that log every keystroke on any wireless keyboard(wired too).

You've put your finger on exactly the thing I've always wondered about: similar to a keylogger, would not a blackhat piece of attack software also be able to intercept and record a password after it has been retrieved from its password vault, just prior to its being sent as an authenticator?

Which is why I'm looking into these FIDO2 devices, which can at least mitigate against such things happening by converting the user's remembered password into more of a single use password (through usage counts, time stamping, and whatever else).

[NeverDie]

After watching a number of youtube reviews of a whole spectrum of password managers, I think I've narrowed it down to either KeepassXC or maybe bitwarden. Both are open source, but Keepass appears to be completely free. I can't yet say for sure, but keepass might also be easier to self-host as well. Because keepass has a database key that's different from the master key, it appears that I might be able to simply put the database file on a commonly accessible drive on the local area network be done. No need to mess with a docker based server, as bitwarden seemingly requires (plus a $10 license fee). For these reasons, I'm presently leaning toward keepassXC.

[LiamW]

@BearWithBeard I've been using Last Pass for a year and a half and didn't know about those leaks...
These articles make me wanna move to another service

[NeverDie]

@LiamW I don't know how one could decide whether LastPass has more problems than the others or whether it's just making an effort to be more transparent about problems if they are found. Or perhaps LastPasss has more problems that have been found (and fixed) because it's more popular, making it better scrubbed down than the ones you hear nothing about? So, perhaps that makes it more robust? Again, how can one evaluate one way or the other? Even if the crypto analysis says it's secure, the implementation (browser extensions in particular) will, I imagine, have some bearing on how bullet proof a particular password manager really is overall.

Which company has the largest bug finding bounty? If it's large but goes unclaimed, then maybe that's at least some tangible evidence as to whether a particular implementation is secure. But then again, maybe the very next maintenance patch might undo all that by inadvertently introducing a new weakness, and so do we ever really know? I mean even if software claims to have been security audited, who knows how thorough that audit was or whether the people conducting it were capable? It's obviously easy to generate a report which says "No problems found." If security audits really worked, then how come vulnerabilities sometimes get discovered even after an audit has blessed it?

[mfalkvidd]

[LiamW]

@NeverDie absolutely agree, man. But a year ago when I was searching for a pass manager, it was just the first thing to pop up. Maybe they're just trying to rank in Google without caring of their customers...

[NeverDie]

@LiamW The way I look at it, you or I don't have the time or resources to do proper due diligence, let alone constantly monitor. Major corporations do though. So, which password managers do major corporations pick? I'd like to know. They're in a better position to get answers to the critical questions, and so in this case I think following their lead would make sense.

[NeverDie]

I can see now why Google Chrome isn't considered a secure password manager. I tested out a different password manager just now, and it was able to import all of my google chrome passwords in about 1 second. I presume a piece of malware could do the same?

[BearWithBeard]

All password managers are a compromise between security and convenience. Those integrated into browsers seem to distinctly favor convenience. Yes, Chrome may sync the credentials encrypted to the Google cloud and they may be locally secured via the OS account login, etc. But did you ever need to authenticate if you tried to access those passwords? Firefox isn't much different - once you're logged into the OS, all Firefox-managed passwords are just three clicks away (unless you opt in to use a master password).

I'd be surprised if someone or something (like malware) that has access to your PC won't be able to read and copy credentials from a browser, at least while the browser is running. Browsers store the credentials in the same location on all PCs, so I assume there is already specialized malware that automatically crawls those locations and kindly "asks" the browsers through their APIs to decrypt them.

I guess it's worth mentioning that dedicated password manager application that you keep running and unlocked in the background all the time, might also leak some confidential data into memory under certain circumstances. Here's a case study that examined how 1Password, Dashlane, KeePass and LastPass could leak data: https://www.ise.io/casestudies/password-manager-hacking/

[Sasquatch]

@NeverDie

The keylogers I mentioned are either usb plug extensions(hard-ish to spot) or Bluetooth dongles that listen to wireless keyboards, some of them use very weak or no keyboard<->dongle authentication.

Intercepting passwords between browser and website/server is possible but requires:
a: MITM attack => access to local network easy peasy on café WIFI
or
b: DNS poisoning => admin access to ISP infrastructure or local network router.

On top of that stupid/not paying attention user who will ignore lack of SSL/https connection or add exception to accept website certificate signed by ROOT CA not trusted by os/browser.
Or physical access to victim's computer to add own ROOT CA to trusted CA's database, malware can do it too.
Only way to rule user error, malware or physical access out it to fake ROOT CA and sign certificate to dodgy server, but it's not possible without access to some serious brute forcing compute power - we are talking exascale supercomputer for couple of years here.
It is very personal attack, and unless you are VIP you can forget about it anyway. I'm not so sure about forgetting...

No password manger is safe on a machine crawling with malware, Antivirus/antimalware are a must!!!
Although there is a plugin for original keepass that auto-types password out of order to fool potential malware keyloggers. It's called floating panel.

AFAIK all browser password managers use windows user password to encrypt them, and changing password automatically changes encryption key too SIC!!
Considering that one can overwrite windows password or disable it temporarily for covert hack!! in 30 seconds with simple bootable usb stick(windows password unlocker) such form of encryption is more than useless in stolen laptop scenario. And Mac's have passwords reset feature baked into o/s so resetting it is even easier.

From time to time there is malware/loophole in browser that leaks passwords, last one was opera on the news.
NEVER USE BROWSER SAVE PASSWORD FEATURE!

[NeverDie]

@BearWithBeard said in Best password manager?:

Here's a case study that examined how 1Password, Dashlane, KeePass and LastPass could leak data: https://www.ise.io/casestudies/password-manager-hacking/

That's a rather damning report. Thanks for posting it. If even those password managers all have glaring holes in them, it casts a dark cloud of doubt over the entire category.

In addition to that, the Brave Browser's docmentation pretty much confirmed what I suddenly suspected about browser extensions: "Are Chrome extensions safe? Not only could a browser extension track every page you visit, download your passwords, and your personal information, but by downloading a dangerous extension, you could inadvertently download malware, adware, and trojan horse viruses. " [source: https://brave.com/learn/browser-extension-safety/]

So, after reading that, I removed all extensions from my browsers except for the password manager. For convenience sake, that's the one extension that I'm allowing to remain. The Brave browser claims to be more secure than the other popular browsers, but I notice that both Google Chrome and Firefox do offer stronger browser settings, which happen to be turned off by default.. I suspect Google Chrome has a conflict of interest regarding browser security: since Chrome is the most popular browser, if Google were to lock down their Chrome to a greater degree by default, it might amount to shooting Google in the foot if it were to interfere with users receiving advertisements or interfere with whatever invasive tracking Chrome otherwise allows. For that reason, I'm reluctantly going to abandon Google Chrome. Brave, on the other hand says it's built on Chrome but also claims to be more secure and run 3x faster, so I'll give it a try. Firefox has settings which allow for greater security, so I'll also try browsing with those settings turned up and see how it goes.

I had thought that running a browser inside a virtual machine would offer a true bulletproof isolation sandbox, but this idea is already well researched and I was surprised to read it actually isn't bulletproof.

Snowden recommended Tails, but a lot of time has passed and I suspect his insights are probably lagging the current reality. Is Tails still the best option available, or is there now something newer/better than Tails?

[BearWithBeard]

Yeah well. Some of those "holes" in password managers are conceptual. You can't display a password or copy it to a clipboard without exposing it. I guess we have to accept that no software is 100% secure and that nobody can ever guarantee such a thing. A lot has to come together before those flaws become a serious threat - and what's the alternative anyway?

Regarding browser extensions: While it's true what Brave is saying, I think it's the wrong conclusion to ditch extensions altogether. Websites themselves, even trustworthy ones, can be malicious. That is because most websites today load content from third parties like advertising or content distribution networks, for tracking purposes and to deliver targeted ads, regionally cached versions of the website or frequently used JS libraries like jQuery. If any of those third parties / CDNs gets compromised, attackers can inject harmful javascript into countless websites. The NYT, Yahoo and Spotify were rather famous victims* spreaders. Even Google's DoubleClick, one of the leading ad servers, has served malware before. (see malvertising on wikipedia).

I understand that there are website owners who rely on ads to fund their projects, and one can always make exceptions for them or compensate through different means (subscriptions, donations,..), but I would never use a browser without any sort of ad- or scriptblocker like uBlock origin or uMatrix these days. I prefer to know and decide on my own which resources and from where they are loaded. They also help to restrict cross site tracking.

Another nice side effect - which may confirm Brave's "3x faster" than Chrome claim - most websites load much faster. Take the NYT frontpage as an example:
No blocker: transferred 28MB in 356 requests, which took 4.43s to load; keeps loading in new images, videos and other resources from third parties every minute
With Blocker: 4.14MB in 58 requests, which took 1.76s; does not load anything from third parties afterwards

It's either that or disable javascript entirely in the browser, which will render many websites useless.

* I'm reluctant to call a website a victim in this case if they knowingly load content from third parties, accepting all the risks involved, but deny any responsibility in case they in turn cause harm to their customers / visitors.

[Sasquatch]

@NeverDie said in Best password manager?:

Here's a case study that examined how 1Password, Dashlane, KeePass and LastPass could leak data: https://www.ise.io/casestudies/password-manager-hacking.

As I said before no password manager is safe on machine crawling with viruses and/or malware
That's where antivirus software comes to play if you skip that there is no escape from being eventually "hacked".

Main advantage of password manager is not reusing passwords for different services. When one gets compromised it's that. One password leaked, one account compromised, rest is safe. Alternative would be pen and paper notepad, reusing one password, or using memorable password combinations all bearing much greater risks than any decent password manager.

IMHO you are getting a bit paranoid, I do agree with BearWithBeard, use as few extensions as practical.
Firefox+adblockplus+kepassxc+cookiecleaner is my "daily driver"
For weird side of internet I use TOR browser.
For testing downloads use VM.
Plus good paid antivirus, so far so good.

[NeverDie]

@Sasquatch said in Best password manager?:

As I said before no password manager is safe on machine crawling with viruses and/or malware

Is anti-virus recommended for Linux as well?

[NeverDie]

@BearWithBeard said in Best password manager?:

would never use a browser without any sort of ad- or scriptblocker like uBlock origin or uMatrix these days.

Ah, good, now that we're getting down to brass tacks, thanks for naming names. The one time I tried using an adblocker I quickly ran into a wall: many sites would detect it and refuse to display content until I disabled it. So, I installed PiHole, which they can't detect, and with one stroke it benefits my entire family. That said, it's only as good as its database, so something nefarious could conceivably slip through. Consequently, I should add something more to cover that possibility. Are the script blockers you named detectable by visited websites? If even the New York Times is a spreader, then you just have to assume any website with advertising might also be. Maybe even non-advertising websites (like the many honeypots offering free this or that) could be bad in that respect, and PiHole would be of no benefit there.

[NeverDie]

Also, my wife sometimes travels overseas, and this creates online vulnerabilities. This time it will be Russia, so, yeah, time to take it seriously. In addition to password manager and yubikeys, I'm thinking VPN so she can simply tunnel out of there and let her firewall reject any attacks from her local network.

[mfalkvidd]

@NeverDie for travel, I would say the largest risk is a border search. US does it, so I would suspect Russia does as well. Good guide: https://www.eff.org/document/eff-border-search-pocket-guide

[BearWithBeard]

@NeverDie I'm not sure how exactly those anti blocker services work, but I think they watch the browser environment, DOM tree or the loaded resources for changes and if they detect deviations from the expected state, they can conclude that some sort of blocker is installed.

So yes, uBlock origin can be detected, as should be any extension that actively modifies websites, depending how good they are in this cat-and-mouse game. But it's impossible for me to tell how much that affects your daily browsing experience, since you and I are most likely visiting different websites. For me, there's actually only one regularly visited website that doesn't let me in unless I disable uBlock.

I'd recommend uBlock origin over others, because it's fast and easy on hardware resources. It has more options and features than Adblock Plus (whose filter syntax it supports), as it doesn't only use filter lists, but can also block scripts and network requests to third party servers and you are free to adjust that for every site individually. It's easy to use, with optional advanced features and has a decent documentation.

uMatrix could be considered a browser-based firewall which allows you to define rather granular rules for different content types (including cookies) per domain. It's definitely not a tool for non-technical users, as it breaks a lot of websites per default. uBlock origin includes a simplified form of uMatrix's features, but it's optional to use them. uMatrix doesn't seem to be in active development for more than a year as I just found out. Still works great though.

[NeverDie]

Answering my own question about Tails, it seems that Kodachi might be a successor: https://distrowatch.com/dwres.php?resource=ratings&distro=kodachi

So, for browsing, I'll probably run Kodachi in a VM and call it a day. That and use a different computer altogether that's reserved for access to financial accounts. That and locking down whatever websites are possible with yubikeys, and I figure this should be good enough security without causing much inconvenience. Even just moving off of Windows as much as possible would probably be a big improvement just by itself.

Along the same line of thinking: using a separate, dedicated computer for network security and IoT control probably makes sense as well, in addition to using vlans (as discussed in the other thread). I figure doing it that way should further increase isolation by physical means rather than just spinning up another VM. Or, maybe still do it as a VM, but be sure to have whatever computer is used for browsing be its own standalone machine on its own vlan, or else perhaps on even its own isolated physical lan. Yeah, come to think of it, that ought to do it, as a blunt Keep-It-Simple method, even if the primary defense gets breached.

[KooLru]

I use KeePass (KeepassXC). Datafile synced with all my devices via ResilioSync (ex BTSync).

[NeverDie]

@KooLru said in Best password manager?:

I use KeePass (KeepassXC). Datafile synced with all my devices via ResilioSync (ex BTSync).

Are you completely happy with it? Any downsides you've noticed?

[Sasquatch]

@NeverDie Linux and antivirus... I say no since only one I can recommend is only available for windows and mac.

@mfalkvidd said in Best password manager?:

@NeverDie for travel, I would say the largest risk is a border search. US does it, so I would suspect Russia does as well. Good guide: https://www.eff.org/document/eff-border-search-pocket-guide

Say whaat? Border officials in US can confiscate my laptop willy nilly? I'm glad I have no plans to travel there, and if I do I'll encrypt the hell out of everything I carry, even my wrist watch will need password to show time

[NeverDie]

Perhaps I'm naïve, but border agents aren't the people who worry me. I'd be more concerned about hackers on a hotel's internet connection, or in an internet cafe, or on free wifi at the airport, or similar.

[BearWithBeard]

Regarding antivirus. I'd say no, you don't need antivirus software on Linux. To my best knowledge, viruses and malware for Linux are still very, very rare, due to the Linux desktop / end user market share being tiny. No big malware campaign would specifically target Linux users, since the potential targets shrink from something like a 90% Windows userbase to like 1% Linux users. Unless you install software from shady repositories (think pirated software) or are directly targeted (as in they're specifically after your stuff, not someones), the risk of getting a virus should be pretty low. Follow best practices like avoid loging in as root / super user, compare checksums, think twice before granting programs elevated privileges, install updates regularly, etc.

Linux seems to be rather well protected against threats anyway. Almost all network equipment runs on some sort of Linux. Most webservers are running a Linux. Maybe I'm wrong, but I bet most of them don't deploy a dedicated anti virus software, other than maybe for file or mail servers, to protect Windows clients.

Wikipedia keeps a list of known Linux malware and points out that "few, if any are in the wild, and most have been rendered obsolete by Linux updates or were never a threat".

On Windows, I'd say you're generally good if you use the Defender / Windows Security that comes with it. It provides more or less the same protection against threats as the big name commercial products and doesn't come with tons of bloatware, AI-based voodoo, invasive DLL injections into other software and stuff or accompanying browser extensions, which unnecessarily increase the system's attack surface.

I guess it's worth mentioning, that antivirus software can be harmful, too. Security software isn't safer or more bug-free than other software. And since many antivirus suites integrate deeply into the OS, malware targeting antivirus software has an easy job infecting the system.

Independently from the chosen OS, the best protection is to keep it and all software up-to-date so that known vulnerabilities can be closed or at least mitigated as soon as possible.

[NeverDie]

It looks as though the Linux distro "Qubes OS" has already been configured to do sandbox isolation for nearly anything, including browsers, along similar lines to what I was thinking, by using VM's via the Xen Hypervisor: https://www.qubes-os.org/ . The first Qubes distro was released years ago, and so Qubes has already been extensively reviewed, and likewise it's also easy to learn about.

There are some special hardware requirements that are worth paying attention to. For instance, Qubes recommends avoiding nvidia graphics cards and using Intel IGP instead of a graphics card. Also recommended is hardware TPM with proper BIOS support. Also recommended is "a non-USB keyboard or multiple USB controllers," and I'm not sure yet exactly what's driving that recommendation, except that I read Qubes assigns even the USB port to its own virtual machine in order to isolate it (presumably against self executing Usb files?). So maybe one USB controller wouldn't be enough to connect a keyboard, but with multiple USB controllers maybe one could be mapped to a keyboard and the other USB controllers passed through and isolated in the VM? So, in practical terms, to avoid all that, maybe this means using a bluetooth keyboard just to keep things simple. Anyhow, I have a spare 6th generation Intel NUC, and I believe it meets all these requirements, so I'll probably spin Qubes up for a test drive.

@bearWithBeard, thank you for the good suggestions.

[NeverDie]

It's topical. Google just announced that it will soon be "automatically" enabling two factor authentication on "appropriately configured" google accounts. So, soon the only question may be what type of two factor authentication you have on your account, not whether you have it or not.
https://9to5google.com/2021/05/06/google-two-factor-authentication/
I view this as a good thing, because it will probably stimulate other websites to consider doing the same. The more, the merrier. Once you're set up for 2FA on one website with one of the better yubikeys, it's very easy to add any additional websites that may demand it. So, this will likely help prime the market for the transition to better tech.

Maybe that's why the inventory of the best Yubikeys on amazon suddenly dried up. I went to buy some more and suddenly it would take a month to get them instead of one or two days.

[NeverDie]

Reporting back for the final time: I tried Qubes, but it runs rather slow on a 6th generation NUC, so it's a hassle to use. Not sure, but maybe on a super fast computer it would be more tolerable.

Anyhow, I think the idea has merit, but I'm not a fan of the Qubes distro. It's fine as a proof of concept, but its choice of apps really limits its fresh-out-of-the-box appeal. If there were something equivalent that ran under ProxMox, I'd probably like it better. From what I've read, ProxMox hypervisor can manage virtual TPMs (or, alternatively, pass through hardware TPMs to virtual machines), and I'd be interested in giving that a try (as it seems like a good idea in any case). So unless there's a reason to think that Xen is inherently more secure than ProxMox, maybe the same general idea (minus the color coding) could be approximated in ProxMox without much effort.

Anyhow, thank you everyone for your suggestions. Though everyone may have their own favorites and good reasons for them, it was useful to compare notes. Ultimately, it seems like
the sort of thing you just have to try for yourself to know whether you like a particular app or not, but starting with a solid list of candidates in the first place really helps a lot.

[Melody Gilpin]

I've purchased the family plans for both LastPass and Bitwarden. I'm torn between the two. I've been alternating back and forth between using them and I much prefer LastPass. Family sharing in Lastpass is vastly superior and easier to use. Bitwarden does family sharing in a clunky and disjointed fashion. Family sharing of some sites is especially important to us. My wife is not technical at all and has learned to effectively use Lastpass over the last 12 years. I've not even shown her how Bitwarden works yet, and I know what her response will be.