What is a really smart choice for password manager apps? Concerned about privacy and politically involved CEOs.

I’ve used:

  • LastPass
  • 1Password
  • ProtonPass (Now using)

I thought ProtonPass was a good choice but I’m starting to read more about it. What’s just a really solid choice all around, that you can feel good about? Free or paid.

Update: I decided to go with Bitwarden and Bitwarden Authenticator. The features and the experience are better than the three listed above that I’ve used before. Awesome advice here, thanks everyone.

  • Gayhitler@lemmy.mlEnglish
    31·
    5 days ago

    Bitwarden.

    You know if you need more than that and if you’re asking on lemmy you don’t need more than that.

      • Gayhitler@lemmy.mlEnglish
        121·
        4 days ago

        I would recommend people not do that unless they know they need to and again, if you know you need to you’re not asking on lemmy.

        Hosting your own secrets not only puts the burden of protecting, providing access to and preserving the secrets entirely on you, but puts a very unique set of hosting goals squarely on you as well.

        Even a skilled administrator with significant resources at hand would often be better served by simply using bitwarden instead of hosting vaultwarden.

        An example I used in another thread about password managers was a disaster. When your local server is inoperable or destroyed and general local network failure makes your cloud accessible backup unreachable, can you access your secrets safely from a public computer at the fire department, church or refugee center?

        Bitwarden works well from public computers and there’s a whole guide for doing it as safely as possible on their website.

  • Lettuce eat lettuce@lemmy.ml
    4·
    4 days ago

    Been a Bitwarden user for several years now, both personal and deployed at multiple small businesses.

    It has been fantastic the whole time. Pricing is great, open source, runs on basically everything, and easy to use.

    KeypassXC if you’re uber-paranoid or a hardcore Stallmanite, otherwise, Bitwarden all day 100%

  • NutWrench@lemmy.mlEnglish
    151·
    5 days ago

    I recommend Keepass. It’s freeware, is available on all platforms and supports biometrics (fingerprints, etc) on Android devices. It also encrypts the password file on your device, so you can keep a copy of that file on a cloud service without worrying if that service really respects your privacy or not.

    • Whooping_Seal@sh.itjust.worksEnglish
      3·
      5 days ago

      This is perhaps overkill, but you can also encrypt the contents of your online cloud storage with CryFS / Cryptomater. This is particularly useful if you wish to store sensitive documents (healthcare, finances etc) in a cloud environment in case of catastrophic destruction of property (destroying computers / on site backups of data).

      In this case you can also backup your keepass file in this encrypted virtual storage medium, on top of the prexisting encryption of the database itself.

  • Churbleyimyam@lemm.ee
    231·
    6 days ago

    Use KeepassXC with Syncthing for maximum autonomy or Bitwarden for maximum ease. Both are FOSS. That’s my recommendation and also seems to be the consensus among those who share your needs.

  • Saltarello@lemmy.worldEnglish
    11·
    5 days ago

    I use Keepass but I recommended Bitwarden to less nerdy family members as it syncs out of the box & does what they need it to do. Sync is simple enough to set up with Keepass & the big plus for me is that it allows storage of files/documents. Last time I checked this was a limited/paid feature on Bitwarden

  • Whooping_Seal@sh.itjust.worksEnglish
    9·
    5 days ago

    My personal choice right now is KeePassXC (PC) / KeePassDX (Android) + Syncthing And Aegis (Android) for 2FA codes, with a yubikey for services that support FIDO keys.

    Overall I like this setup because it’s decentralized and does not rely on a third party server structure. The only “weak” point would be the Syncthing relay servers or the Tailscale VPN that I use, but this goes back to ensuring encryption of the database is adequate with a long password, and using an open source synchronization protocol that ideally has been vetted by a trusted third party (or yourself if you’re capable)

    I used to use Bitwarden, and I highly recommend it. I really appreciated it’s ability to integrate with email aliasing solutions to generate new aliases from within the bitwarden UI itself. However, my main reasons for switching were the following

    • I don’t have the money to pay for it (uni student)
    • I prefer a more self-hosted approach (I will consider using vaultwarden in the future when I have more money)
    • I wanted to move away from using a browser extension for password management on desktop. KeePass’ auto type feature is really good, and a more secure input method than a browser extension autofill.

    The only additional advice I have for both recommendations is that I do not think it advisable to add Totp 2fa information to your password manager even if it supports it. I feel like this should be separate, on a single device, and backed up in ~2 locations (one preferably off site). This is really to avoid problems if a device is compromised and if your password manager is compromised, but this is definitely in the more unlikely category I feel.

    My only major issues with keepass are the potential for sync conflicts and the some feature differences between platforms. A centralized server config like vault/bitwarden prevents the sync conflict issues, at the cost of having one point of failure. The feature differences problem isn’t too great, but autotype doesn’t work on Linux if you install with flatpak, and you can’t prevent screen capture of the app on Linux (only on Android and Windows from my understanding)

    Edit: I also tried gopass, it’s really fun to have an entire CLI based password manager, but frankly the state of mobile companion apps are appalling. The Android option only is good if you use a dev version, and the iOS one I thought was just ok. I also dislike the metadata leaking that is inherent to the format, and that PGP is the main form of encryption for the time being (some clients were looking at using AGE at some point). Overall it’s a cool but flawed concept, and I feel my other two recommendations are superior.

  • deathbird@mander.xyz
    5·
    5 days ago

    No one has mentioned pwsafe, which was originally created by Bruce Schneier and is still maintained.