Password management

[Harryo]

The amount of different passwords I have is ridiculous, I’m constantly forgetting. How do you all manage yours?

@CityCommuter

Is it possible for a password manager website / app to get hacked or are they actually un-hackable?

Nothing is unhackable. Let's put that at the top of the page and work around it.

Anyone who tells you something is unhackable can be ignored from that moment on.

Returning to reality - bearing in mind my point that once you press "enter" you have no idea what happens to that data - the next best thing is to assume others incompetence (fairly easily done, usually) and protect yourself as much as possible.

In my case it's (a) not trusting Lastpass to be around tomorrow, so making a copy of my saved data locally; (b) never reusing passwords and ensuring every site I use has a unique password (Lastpass has a tool to do this for you) and (c) most importantly - make sure the really important stuff has extra protection. So 2FA, and a setting to require Lastpass to force you to re-enter the main Lastpass password on anything like account data.

Remember, someone could also break in, and start cutting fingers off you to get you to talk, so there's only so far you can go to be secure when other people are involved.

One of the nice things about Lastpass is you don't need to "install" it anywhere. They have a browser plug-in, which makes things 10x easier.

So.. .that would be 1-2 browsers on each of the devices.. .and no way I could have a plug-in installed any work device. Ultimately there would just be "one" password code -- which is really the same as just remembering my email password, isn't it? I don't see the difference, I guess LastPass must be a little faster than 'resetting' passwords each time for the obscure impossible to remember password websites.

I am having palpitations remember all the passwords I had to keep track of for NHS job. I emailed myself the full list each time I changed any of the pws. There was no other way to keep track.

I loathe 2FA. I have to hunt for my phone each time & sometimes the text or other confirmation message takes ages to come thru.

Just downloaded this as I’m terrible with passwords. Most websites I have to change every time I log in.

What happens if I forget the master password?

Seems like a hassle to enter all passwords into it because it’ll mean lots of resets to make new passwords for it. Is there any way to import the info?

You can't import them en masse say from being saved in another browser. But if you have the plug-in or app logged in, when you log in to another website lastpass asks if you want to save the details and you say yes. I think the same if you have it logged on in a browser window, but I don't often use it that way. You can also add and edit them manually. You don't have to change them, but I have gradually changed mine as I've used them. It can be a bit glitchy getting them saved, but overall it's easier than trying to remember them all or doing repeated resets.

@lljkk

I loathe 2FA. I have to hunt for my phone each time & sometimes the text or other confirmation message takes ages to come thru.

Not all 2FA is texty codes. You can get code generators that run one your phone (OK, you still need your phone, but no waiting).

Proper 2FA setups also allow you to generate a set of one-time codes you can keep on a piece of paper if you're out of signal.

@lljkk

One of the nice things about Lastpass is you don't need to "install" it anywhere. They have a browser plug-in, which makes things 10x easier.

So.. .that would be 1-2 browsers on each of the devices.. .and no way I could have a plug-in installed any work device. Ultimately there would just be "one" password code -- which is really the same as just remembering my email password, isn't it? I don't see the difference, I guess LastPass must be a little faster than 'resetting' passwords each time for the obscure impossible to remember password websites.

I am having palpitations remember all the passwords I had to keep track of for NHS job. I emailed myself the full list each time I changed any of the pws. There was no other way to keep track.

I am having palpitations remember all the passwords I had to keep track of for NHS job.

A good IT setup wouldn't require you to remember loads of passwords. Sounds to me like you're working where you are told what the "good ideas" are, rather then their emerging organically from user requirements.

NHS & "good IT setup". Now you're having a laugh.

Lasspass have just started charging to use their vaults on more than 1 device so I moved everything over to bitwarden.