Use the "passwords" feature to check if one of yours is compromised. If it shows up, never ever reuse those credentials. They'll be baked into thousands of botnets etc. and be forevermore part of automated break-in attempts until one randomly succeeds.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 year ago (8 children)

And when that password manager gets cracked?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 7 points 1 year ago (4 children)

    Got any examples? Because I have…some…examples of password reuse being a real-life problem.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 5 points 1 year ago (3 children)

    LastPass recently, check Addie Lamarr’s channel on YouTube.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 1 year ago (2 children)

    LastPass is the maximum shit. They got hacked like 3 times in a year and my company‘s password notes got leaked.

    We are now with Bitwarden and this was the biggest security hardening measure we have taken.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago

    Yeah, I left LastPass after like 15 years when I've come across some news headlines that it had got breaches more than once while I was using it O.o

    Been a happy user of Bitwarden for a couple years now. I love that little "copy custom field name" function, so I don't have to go hunting around in the HTML code if a site is using weird field names.

  • source
  • parent
  • [–] 4 points 1 year ago

    I seem to remember that the passwords were encrypted so, all they got was the passwords people use for their password manager which because people were using the password manager and therefore had random passwords it didn't really matter hugely.

  • source
  • parent
  • [–] 3 points 1 year ago (1 child)

    Just as an example, 1Password has a secondary encryption key that they can’t even recover. If you lose it, you’re fucked. I doubt the chances of that being cracked are any good at all.

  • source
  • parent
  • hideshow 1 child comment
  • Bitwarden has no secondary key, and the master key is never sent to the server. All they get is an email address and encrypted data. If you forget your key, your passwords cannot be accessed, which means an attacker is screwed too.

    There are tons of ways to give yourself ways to "recover" your password that don't compromise you in a breach scenario:

    • logged in devices - they have the key decrypted and can generate a new one, re-encrypt, and overwrite the data server-side
    • store a physical copy of the password at home somewhere (notebook?)
    • share passwords with a trusted person (SO) for critical shared accounts
    • securely store an unencrypted backup of your password vault (say, on a personal computer with full disk encryption)

    Maybe that's how 1password works, idk, but I do recommend verifying that there's no password recovery option on whatever password manager service you use.

  • source
  • parent