Okay, after reading this story about the difference between security experts and non-experts, feeling like I should get in on this keepass thing.

http://googleonlinesecurity.blogspot...-security.html

Not sure how it works or if there's software for it on iOS. Will do some reading.

1Password is what I use and is very nice experience if you're a mac/ios person. They have windows version too but not as great as the mac versions.

To use keepass on your mac have a look here: If you have your keepass database in a veracrypt container, there is a 0% chance that anything else but government agencies will be able to obtain your passwords from your system.

I have it set up that when I plug my phone to my pc, the database on the phone updates itself to the pc version. That allows me to have my passwords with me and use them on the phone obviously. By that, you get the weak point of having your database on a service like dropbox out of the way. In contrary, you can use dropbox to increase the security level by a huge margin when you use a keyfile + master password to access your keepass database.


And the biggest improvement in security for you is that the password manager conveniently allows you to have a separate password for each and every account on whatever site you have. Meaning that if hackers steal your passwords from Ashley Madison, they don't automatically have your brazzers account as well.

Sourceforge spammed heavily when they got the great idea to capitalize on abandoned projects they host. Here's a link to a background story.

Looking for a good password managing program. Ideally it will require 2FA such as google authenticator to access the password list.

Have you looked into the ones listed in this thread?

I only use Lastpass and that does have 2FA available, although it is not enabled by default.

So lastpass was hacked, but we are recommending it?

Well, the hack was like a year ago, so sure, why not?

Or use keepass.info, it's open source and legit, got trough a major audit.

So is keepass safer than Lastpass?

I use Lastpass, but after reading this thread, not sure.

IMO keepass is only safer in that the database is housed local to your computer, so someone would have to hack specifically your computer then hack the database. Whereas, a hacker could (and did) hack lastpass and get their entire database.

However, the encryption used by lastpass is unbelievably good. So as long as your master password is good (tip: use a diceware password), then your database is safe. More so if you use 2 factor authentication.

I use lastpass and I have absolutely no concerns whatsoever.

use lastpass + google authenticator, feel pretty safe.

If they get my passwords, I'll just generate new ones. :shrug:

http://lifehacker.com/keepass-vulner...-pa-1781486764

keepass vulnerability detected

I don't really get it. I use keepass, but I thought it was all just kind of a conglomeration of somewhat decentralized services? (can choose from a few different apps, store your key file anywhere, etc.) I don't really understand it tbh. I'd like to, just didn't put the time in.

I still use lastpass,
but the only thing saved there are passwords for game email and sites..
Most of my personal password(like online banking,paypal,etc...) i memorized and the only copy just incase i forget is in my cellphone

That doesn't make any sense to me lol. Most password managers shouldn't be relying on your cell phone, any time you're trying to log into a website you're on a computer with internet access where you should have access to your password manager...

What sort of major audit didn't detect a vulnerability in the update mechanism? and that is a pretty basic one.

i understand what you mean... but i just want to be safe.. so i dont save anything in my lastpass that may give me alot of problems if hack...
i even only have the copy for my password on a txt file in my cell.

And how well protected is the file on your cellphone?

https://arstechnica.com/security/201...word-managers/

This one wasn't a hacking, but a major exploit that allows remote code execution and password theft. Although it is different than the other two recent flaws that were pointed out by the same security researcher.