Password Security Catch-All Thread

Thanks deJanzie!

*Legion* wrote:

Bitwarden self-hosted (with occasional JSON backup exports stored in a VeraCrypt vault) remains my approach.

Another year-plus later, this remains my go-to solution, and absolutely nothing has made me think twice.

Previously I was running the self-hosted instance on an Intel NUC running Ubuntu, but I built an Unraid server last year, and I migrated to using the managed Docker app version in Unraid. (Migrating was as simple as taking a fresh JSON backup from my running instance, bringing up the new instance, and then importing into the new one).

Self hosting isn't for everyone, but if you use a platform like Unraid, it's definitely easier than doing it manually.

Thanks Legion! Probably won't go that route but it's interesting.

If you are looking for a commercial one, I have been generally happy with 1Password.

I'm very happy with Bitwarden myself.

Auto-fill in some apps on Android can be a bit spotty in my experience, and some times it doesn't seem to pick up password changes on some sites. But those are minor and sporadic.

MrDeVil909 wrote:

I'm very happy with Bitwarden myself.

Auto-fill in some apps on Android can be a bit spotty in my experience, and some times it doesn't seem to pick up password changes on some sites. But those are minor and sporadic.

This is my experience as well. Generally good, but some weird quirks that might scare off someone that's not great at tech.

I didn't think Bitwarden had an auto-fill function as that was one thing I lamented missing when I switched from Lastpass. Guess I'll keep it off now that I'm used to not having it.

If you go into Settings on Bitwarden, auto-fill is the first menu option (at least, in the Firefox extension, it is).

If you want to use auto-fill on Bitwarden, I would recommend enabling the feature, setting the default global behavior to NOT auto-fill, then you can selectively enable the auto-fill behavior for specific websites that you can trust to keep their login pages relatively secure (ie. the odds someone can sneak an autofill-capturing iframe onto the Amazon login page is pretty damn low)

This is disheartening news, but par for the (wickedly difficult) security course. Sigh.