Most PRIVATE Password Manager

Поделиться
HTML-код
  • Опубликовано: 2 июн 2024
  • Using a password manager is actually one of the most IMPORTANT things you can do to safeguard your digital life. Password managers are software for generating and storing your passwords for you.
    While keeping all passwords in a single vault may seem like a scary prospect for some people, we explain why computer security experts almost unanimously recommend using them.
    We also dive into which password managers are best, and how to keep your password vault secure.
    00:00 Intro
    01:08 Creating better passwords
    04:58 Securing your Password Manager
    06:44 Choosing a Password Manager
    08:55 LastPass
    11:21 Bitwarden
    12:47 Dashlane
    14:48 1Password
    16:19 KeepassXC
    19:03 Saving passwords in browsers
    21:13 Summary
    The biggest risk to the average person is reusing passwords across websites, so a password manager is essential in order to both create strong passwords and to help you remember them. They can dramatically help you improve the security of your online accounts and make it easier to manage your login information.
    XKDC Comic on Passwords: xkcd.com/936/
    EFF Password List: www.eff.org/files/2016/07/18/...
    Brought to you by NBTV members: Reuben Yap, Lee Rennie, Sam Ettaro, Will Sandoval, Michael Perklin, and Naomi Brockwell
    To support NBTV, visit www.nbtv.media/support
    (tax-deductible in the US)
    Sign up for the free CryptoBeat newsletter here:
    cryptobeat.substack.com/
    Beware of scammers, I will never give you a phone number or reach out to you with investment advice. I do not give investment advice.
    Visit the NBTV website:
    nbtv.media
    Watch this video on Odysee!
    open.lbry.com/@NaomiBrockwell...
    ________________________________________________________________________
    Here are a bunch of products I like and use. Using these links helps support the channel and future videos!
    Recommended Books:
    Beginner's Introduction To Privacy - Naomi Brockwell
    amzn.to/3WDSfku
    Permanent Record - Edward Snowden
    amzn.to/305negc
    What has the government done to our money - Rothbard
    amzn.to/2KMzmcu
    Extreme Privacy - Michael Bazzel (The best privacy book I've ever read)
    amzn.to/3BLZ1gq
    No Place to Hide: Edward Snowden, the NSA, and the U.S. Surveillance State - Glenn Greenwald
    amzn.to/2UQmJ4m
    Naomi's Privacy Bag: some of my favorite products to help protect your privacy!
    Use the Brave browser! brave.com/nao076
    USB-C to ethernet adapter:
    amzn.to/2lOVBoy
    Faraday bag (signal stopping, to protect your fob, credit card, computer, and phone)
    amzn.to/3DjIvCP
    Data Blocker (if you're charging your phone in an unknown port, use this so that no data is transferred)
    amzn.to/2SVh0J2
    Computer privacy screen (use your computer in public? Keep your information safe! Choose the size right for your computer)
    amzn.to/3F816Sn
    Phone privacy screen (don't let people in public see your private data, choose the size for your phone)
    Samsung note 10 - amzn.to/3wNtYwb
    iPhone XR - amzn.to/3Q8Sq4S
    Pixel 6a - amzn.to/3i9dnQz
    Camera cover (for computers and phones, so no one can access your camera without you knowing)
    amzn.to/3Z1N8Mz
    Privacy Tip: Turn off your wifi and bluetooth when you're not using them!!!
  • НаукаНаука

Комментарии • 739

  • @esquire9152
    @esquire9152 Год назад +64

    Last year I moved from Avira Password manager to Bitwarden. I really like the simplicity, open source and security of Bitwarden.

    • @Fian_so
      @Fian_so 8 месяцев назад +7

      I've found one sticky problem though , and I wonder if anybody can help : Bitwarden shares it's clients IP address with gov agencies !?!😑
      Being in jurisdiction that is part of the 5eyes alliance ?

    • @mynameisdavidwalters
      @mynameisdavidwalters 5 месяцев назад

      how do you come to this conclusion? Any sources?@@Fian_so

    • @gsftom
      @gsftom 2 месяца назад

      Would be interesting to see a reply to this.

    • @unholydonuts
      @unholydonuts 2 месяца назад

      @gsftom that would be interesting.

    • @Felttipfuzzywuzzyflyguy
      @Felttipfuzzywuzzyflyguy Месяц назад +1

      ​@@Fian_soEvidence/references?

  • @louis-grasset
    @louis-grasset Год назад +123

    Hey, Dashlane engineer here, awesome video (sincerely, it's valuable and transparent, well done). Side note: Dashlane shut down the Password Changer feature due to maintainability costs and difficulties in scaling websites support over time

    • @mhzprayer
      @mhzprayer Год назад +11

      Oh wow thx for this comment..that was truly an eyebrow raiser when she mentioned that. But I guess..it really was too good to be true

    • @NaomiBrockwellTV
      @NaomiBrockwellTV  Год назад +10

      Yeah I presume that's why most of these things get deprecated. I noticed they now have support for ios apps that can also be used on macs, is this essentially the same thing as a desktop app?

    • @davinp
      @davinp Год назад +3

      Other password managers don't have this convenient feature and this is why they don't have it.

    • @louis-grasset
      @louis-grasset Год назад +2

      @@NaomiBrockwellTV True, implementation and support for this technology represent a non negligible cost for a success rate that is currently too low for a paid feature

    • @clinten3131
      @clinten3131 10 месяцев назад +1

      Its also not often you need to use this feature so cost vs usage is probably bad. As a Dashlane user for 2 years think it is a great password manager. Also the vpn is decent and nice to have.

  • @Nosiu
    @Nosiu Год назад +10

    I am a self-hosting nerd and mainly use my own instance of Vaultwarden. That way I am in charge of security, and - even if it's a hassle - have full control. On the other hand, if something leaks or breaks, it's all on me.

  • @xellaz
    @xellaz Год назад +3

    Very well thought and helpful tips regarding security and management of passwords! I've used most of the password managers mentioned here--both the online and offline versions. I have tons of passwords and it was an eventuality for me to end up using one. Thank you for your continued efforts in bringing awareness in cyber security. 👍

  • @brentpetershere
    @brentpetershere Год назад +2

    An incredibly digestible explanation of what I know is important to consider, but also of what I had no idea is important to think about.
    I feel well equipped to now make an informed decision. Thanks a mil!

  • @2Nu
    @2Nu Год назад +38

    This is sound advice, well thought out and presented. Thank you Naomi for providing this invaluable information to us user plebes. Keep up the good work.. 👏

  • @gariaf
    @gariaf Год назад +6

    I was waiting for this video since the 2FA video you published a couple of months ago. in the meantime, I decided for a PW manager and I'm glad to coincide with your suggestion based on my needs, I guess your previous educational videos worked for me, thanks!

  • @martinwalker3088
    @martinwalker3088 Год назад +1

    Finally catching up with you Naomi. It was another incredibly enlightening upload. Just brilliant and thank you once again.

  • @guacfiend
    @guacfiend Год назад +4

    Providing a comprehensive review of the most prominent password managers and maintaining consistency is always welcome :D

  • @AmazingPhilippines1
    @AmazingPhilippines1 Год назад +1

    COOL! Appreciate all you and your team does. Always lots of good info!

  • @alexanderkoponen7075
    @alexanderkoponen7075 Год назад +1

    Home run! Such a great video, flawless! I'm sending this to all my friends.

  • @TheLazyJAK
    @TheLazyJAK Год назад +2

    Fantastic video! Every point I could hope for you to cover was well explained.

  • @jimcabezola3051
    @jimcabezola3051 Год назад +3

    Another superb video! I’m beginning to understand the differences among password managers. Mahalo.

  • @midnightsky2895
    @midnightsky2895 Год назад +7

    This is probably the best video to explain password managers and how they work. Great job!

    • @adam.maqavoy
      @adam.maqavoy 2 месяца назад

      Sad part I found out about (Both our Schools and Library) in 2018.
      You can only write short *Passwords* 90% of the time.
      And *Our Library's* don't even let you set a password, let alone store anything.
      But they do allow both
      CD & USB usage..

  • @iblackfeathers
    @iblackfeathers Год назад +4

    this is an awesome video. thanks for breaking it down so it can be shared to others.
    one of the best password managers for users at the time with regards to usability, convenience and security out of the box was 1password standalone version.
    although it is not open source,
    unlike bitwarden or keepass xc, it didn’t require setting up a dedicated server to sync across local devices.
    it synced from a primary computer to other devices on the same local network. and you can change primary computers at any time. this limits your surface area of potential attacks by not requiring any cloud or even any always-on local server as a target for attackers. you can simply turn on your computer which devices sync to , unlock it, connect your devices to the same network, and then turn that off when you are done.
    today this does not seem possible without putting way more extra work and dedicating a server for this function. it’s more steps and stuff you have to deal with when compared to how 1password did it all through software local syncing.
    since 1password changed business models to force the cloud and a subscription model, the only option now is bitwarden or keepass xc on an encrypted volume for the same usability. keeping it off the cloud requires way more work / effort in setting up a local server in the form of something like nextcloud or other instance. then you can layer it with a docker container, vm, veracrypt or other encrypted volume, etc…
    the point here is it gets more complex with more in-depth troubleshooting issues because there are far more moving parts. 1password standalone version was like 75% to 90% of the way there for users without further setups.
    lastly, you didn’t mention strongbox and other various “accessories” but i also see that probably you wanted to keep things clear since it is already a very well done and detailed overview video.
    perhaps a more advanced part 2 can delve in local db encryption, syncing and storage methods. linux is also a wildcard since there are more unique scenarios. also if the cloud has to be used for whatever reason, like business, there is now proton drive in the mix of other options. and cloud always requires some form of encryption method with a good way to sync them.

  • @rustyrebar123
    @rustyrebar123 Год назад +52

    This was a seriously well done video with tons of useful information distilled in easy to understand language. Your examples and descriptions of things like rainbow tables and hashing, your overview of the lastpass issues, your description of how to create secure passwords were all spot on and solid from a security point of view, which is rare in videos like this. You could give this video to any level of user and they would come away with a solid understanding of the topics covered. I appreciated your discussion of the pro's and cons of the various password managers and where they might / might not be useful. It is very rare to see such a well done video on these topics. You earned a subscription and $20 donation from me.

    • @NaomiBrockwellTV
      @NaomiBrockwellTV  Год назад +6

      Thank you so much!!!! I really appreciate the support!

    • @victorforzani3433
      @victorforzani3433 4 месяца назад

      you must know this person to agree on what ever she have said just for views not that is the only solution.

    • @rustyrebar123
      @rustyrebar123 4 месяца назад

      @@victorforzani3433 I have no idea what you are trying to say. Maybe try with a coherent thought?

    • @victorforzani3433
      @victorforzani3433 4 месяца назад

      @@rustyrebar123 what Im trying to say charlock is that companies are being hack every day, and I would not give my financial information to any company to secured, I rather have if with a pass key that I control how was that, did you get it now do I have to Draw a map for you.. I think you must be a KId not to understand what Im saying., but that is ok we all cant be Genius.

    • @kidslovesatan34
      @kidslovesatan34 4 месяца назад

      Your grammar is terrible and your thoughts poorly expressed.​@@victorforzani3433

  • @walterxplinge3867
    @walterxplinge3867 Год назад +10

    I started using a password manager when I worked in client support for an outsourcing company. Needed to remember (or store) over 250 passwords for access to the various devices and systems which fell under my purview. I felt I needed something secure but with local-only storage of the passwords. Settled on B-folders. Only stored locally, but able to be synchronised over multiple platforms. It generates random passwords which can include upper and lower case characters, numbers and special characters. Storage of the passwords is local only, and synchronisation is manual-only and via local WiFi. Never had any issues with passwords being compromised. Old tech, but seems more secure than putting your passwords in the cloud.

  • @vanishperish9287
    @vanishperish9287 Год назад +5

    Great episode. These things should be mandatory subjects in school.

  • @Algolxxxxxx
    @Algolxxxxxx Год назад +3

    After trying 1Password, Bitwarden, LastPass and KeePassXC - I decided on KeePassXC. It's open source, self- contained and can happily sit on your system without requiring a Internet connection. It has a ton of other features too.

  • @muscleweb
    @muscleweb 11 месяцев назад +1

    I just got word Proton is releasing an open source code password manager. This is the one I’m waiting for. Great video. Thank you!

  • @drickzee
    @drickzee Год назад +1

    It's the dance at the end for me. Haha Great content, as always!

  • @89robbied
    @89robbied Год назад +4

    Excelent video! I've been pushing my frineds and family to password managers for the past year. I'm about to give a presentation to my company to push for change as well. I will be adding a lot of the information you gave here. Thank you so much!
    Aslo, great to hear you on Micheal Bazzels podcast, that was a fun surprise listening on a flight las week.

    • @NaomiBrockwellTV
      @NaomiBrockwellTV  Год назад +1

      Awesome to hear!

    • @gmansi
      @gmansi Год назад +1

      "I'm about to give a presentation to my company to push for change as well"
      What product do you recommend for your company?

  • @Joromonni
    @Joromonni Год назад +2

    great video naomi! i've been happily using bitwarden for the last 5-6 years.

  • @amt_achrya
    @amt_achrya Год назад +1

    Just the video is was waiting for, thanks for the video

  • @vernearase3044
    @vernearase3044 Год назад +17

    1Password also uses both a master password and a secret key, which is a 32 character alphameric key which adds 32^36 levels of entropy in case your vault is every captured.
    I feel much more comfortable using a memorable master password for my private vault because of the additional entropy afforded by the private key.
    Of course if your device is stolen and there's no protection on the device, the memorized secret key protection goes out the window.

    • @yuchoob
      @yuchoob 7 месяцев назад

      Which is why 1Passwords method is, ultimately, flawed. People download the PDF onto their computer and that's it. I much prefer Yubikey. You can have it on your keychain (not with your phone/laptop) and have spares (one at the office, one at a friend's house) without compromising security.

    • @whulum
      @whulum 6 месяцев назад

      Word. Really convenient feature to have for peace of mind

  • @GaryLachance123
    @GaryLachance123 Год назад

    Awesome video! Thanks for sharing this essential info so well! 😊🎉

  • @nashwanbaxtiar7718
    @nashwanbaxtiar7718 Год назад +1

    I really love your channel. I do care about privacy and security . I learn alot from you from now on . Thank you

  • @JonDiPietro
    @JonDiPietro Год назад +11

    I've been complaining about LastPass forever because their interface was clunky and they hadn't made any changes in years. Well, they just released a new version and it is not completely and utterly UNUSABLE. Which is fine because it has finally given me the push I need to move to a better solution. This video was helpful so thanks!

    • @willy7968
      @willy7968 Год назад

      which one are you migrating to

    • @ajbrady4357
      @ajbrady4357 Год назад

      Look into 1Password. I know you probably have - but they have great blog posts about their security practices and how they exactly work

    • @countermeasuresecurityengi9719
      @countermeasuresecurityengi9719 8 месяцев назад

      proton pass

  • @FengLengshun
    @FengLengshun Год назад +2

    Yoo, the xkcd comic actually appeared here. Nice. That's what inspired me to get password manager. Used to use lastpass, then migrated to BitWarden since I heard it's open source. Thank god I did. And it's a nice balance of convenience and security too. We also need more TOTP 2FA in general though. Or at least something more secure than SMS.

  • @arefmoin814
    @arefmoin814 Год назад +2

    Great video Naomi. I wish you had spent some more time on the browser extension XSS threat surface and also on mobile apps for these password managers, e.g. KeePassium for KeypassXC and advice on using these stand-alone v/s credentials auto fill. Thanks again.

  • @bpresgrove
    @bpresgrove Год назад +1

    Great stuff as always. I had to smack my forehead after watching this one. We use a password manager at work but I never thought about the home. Guess I'll be investing in one. Took your advice on Libre office and love it so now it's passwords.

  • @felicitygee381
    @felicitygee381 Год назад

    Loved the dance and the strawberry vest jumper. Info was really clear as well thanks.

  • @skye1212
    @skye1212 Год назад +4

    I left Lastpass for Bitwarden. Also changed my gmail, apple id and bank passwords.

  • @nathanhallisey441
    @nathanhallisey441 Год назад +1

    Been using dashlane for a few years. Works good enough for me. I might change to bit warden when my subscription runs out.

  • @nully.emptier
    @nully.emptier Год назад +3

    Great video... I recommend open-source BitWarden which can be self-hosted on own VPS protected with own open-source VPN

  • @jezzamobile
    @jezzamobile Год назад

    EXCELLENT Video & channel!
    Most helpful.
    Thankyou 😊

  • @berndeckenfels
    @berndeckenfels Год назад +5

    BTW 2fa Protection of your vault (download) access is easy but does not help against attacks like stolen vaults (like in the recent breach). Only tokens generating part of the encryption key would help here. Yubikey can do that with the HMAC mode but this requires a local/offline app to do it.

  • @richardblais7445
    @richardblais7445 6 месяцев назад +1

    wow,i love your video !!!! thanks for the advice.very very interesting. im a new fan 👍👍👍

  • @kevinobrien2366
    @kevinobrien2366 Год назад

    Great video, thanks. Thorough job

  • @robertwilliam5527
    @robertwilliam5527 9 месяцев назад +15

    Apparently a sheet of paper is the safest way to store passwords

    • @mauricioflores3732
      @mauricioflores3732 2 месяца назад +1

      Saving yes but creating a strong one not really. AI can easily crack human base passwords 😅

    • @markrothenberg9867
      @markrothenberg9867 2 месяца назад +1

      At work my desktop support staff would routinely find an employee’s computer login and password on a sticky note attached to the underside of the keyboard, in the pencil drawer or worse yet written very small on the corner of the cubicle whiteboard. My employees would destroy the paper or erase the board requiring the employee to change their password-but not their bad habit.

  • @chalion8399
    @chalion8399 Год назад +19

    Good info. I also agree 2fa is needed too, as a (minimum) secondary layer of defense, but with family members, getting them to keep using it is problematic. I'm a bit of a paranoid about password security, so mine is a bit different than most users.

    • @BillAnt
      @BillAnt 8 месяцев назад +2

      The problem with 2FA especially via SMS is the inconvenience of having to type a bunch of codes every time you log in. Also 2FA by SMS is vulnerable to SIM swapping and SS7 signaling. Using a 2FA app may not work if the phone loses cellular connection, gets lost, stolen, and also having to type long codes. IMO if one uses a good password manager or even the built-in browser one with long, strong, and unique passwords for each login, that should suffice for the average user. I just don't like password managers or even the browser syncing the password file to the cloud, it's just one more opportunity for hackers, and the bad guys to snoop on it. I would only use an offline password manager like KeePass or the like.

  • @gsftom
    @gsftom 2 месяца назад +1

    This is a great video. Thanks for sharing what you know with others. I love you what you do and share.

  • @nhgreg
    @nhgreg 5 месяцев назад

    Very informative, thanks!

  • @DudeHomer
    @DudeHomer Год назад +2

    YOU are brilliant.....you make your presentations in a way where he Average Joe can understand (most of) the content. I am technically-challenged, and don't understand all of it, but I like your style!😁😁😁

  • @ogcrypto6022
    @ogcrypto6022 Год назад +2

    Great video Natalie

  • @jan6963
    @jan6963 Год назад +3

    Thank you for your videos and the work behind them. Thanks to these videos, I am almost completely away from Apple, Google and co. Keep up your great work.

  • @jkhouryns
    @jkhouryns Год назад +3

    Great video, thanks. What about password managers such as Samsung Pass or Microsoft Authenticator, and some similar ones?

  • @BobJones-dq9mx
    @BobJones-dq9mx Год назад +1

    Thanks for the excellent video!

  • @galaxytrio
    @galaxytrio 4 месяца назад

    Very useful, Naomi.

  • @JoshuaMichail0
    @JoshuaMichail0 4 месяца назад +1

    For twenty years I've used passwords that I had to write down on paper. I make sure they're 26 characters, if possible, with numbers, lower case, upper case, and symbols. I also make sure there are no repeated characters, no reused passwords between accounts, and no clues to personal identity information, nor common phrases or media references, included in the password. But, for a long time I've been using a password manager with biometric security coupled with MFA.

  • @Steliosgiannatos
    @Steliosgiannatos Год назад +37

    I personally use the original keepass, I find the use of complex triggers really helpful, but I have also used keepass xc in the past and is a really polished open source password manager that I definitely recommend !

    • @sebastiangonzales46
      @sebastiangonzales46 Год назад +2

      same i use it with otp it works flawlessly

    • @Steliosgiannatos
      @Steliosgiannatos Год назад +1

      @@sebastiangonzales46 yes best thing ever writing the whole thing!

    • @Steliosgiannatos
      @Steliosgiannatos Год назад +9

      @@Hrubicundus keepass has something called triggers, you can find out more in the official website. You can do complex stuff or even simple quality of life stuff. For example I have a database for my personal passwords and one with all the subscriptions of my family ie. Netflix in a common database. With a trigger you can open the database automatically with a reference to a specific entry in the database (so the password of the database you try to open is not hardcoded into the trigger) or you can import whole databases into one for organizations or you can make it so that a file is saved on your PC and then automates moved to your Google drive Dropbox etc by the trigger. So you won’t have sync issues. The possibilities are many and there are a lot of stuff you can do. Also I failed to mention the plug-ins support !

    • @la3135
      @la3135 Год назад +1

      @@Steliosgiannatos A trigger is a nice feature. Just checked the documentation, however it's not available on KeepassXC on MacOs. This trigger feature is massive and i would like to use it. Any ideas for users on MacOS? Other clients?

    • @user-tp5yb4hr4w
      @user-tp5yb4hr4w Год назад

      i have been using what MacAfee used before he passed away. that man took all his secrets to the grave.

  • @willweiss3205
    @willweiss3205 Год назад +1

    Thanks for the great content and help Naomi

  • @DronesTwinkies
    @DronesTwinkies Год назад +1

    I like the way you call your passwords manager "Madoffpasswords" classic love all your stuff. 🤣😅 Keep it up Naomi.

  • @cafairchild93
    @cafairchild93 Год назад +1

    Love the end dance!

  • @mintydog06
    @mintydog06 5 месяцев назад +2

    I followed you on Odysee as soon as I saw your pop up, nice work!

  • @Jackalleyway
    @Jackalleyway Год назад +4

    Love the dance at the end! 😄

  • @NoEgg4u
    @NoEgg4u Год назад +7

    If you use KeePass (or one of its forks), your vault (a single file) is saved on your PC (and for 99.99999% of us, it will be a small file -- only a few MB in size).
    To avoid a catastrophe, make a copy of your vault (copy that file) to a different storage device, such as a USB drive, and keep that USB drive unplugged after you make the copy.
    This way, if you are hit with ransomware, or similar, you will still have your vault available to you from your USB drive, and that drive was kept safe because it was disconnected from your compromised PC.
    Also consider keeping another copy of your vault at a friend or family member's residence. This will protect you in the event of a burglary (where both your PC and USB drive get stolen) and in the event of a fire.
    As long as you use a strong, unbreakable master password, you can store your vault file with anyone -- including cloud storage. But remember that if someone steals your PC, they might be able to use it to gain access to your cloud storage account and delete your files. So make sure you have a copy of your vault file kept somewhere that it will always be available to you.

    • @TonyRule
      @TonyRule Год назад

      Get a decent backup system instead of this time wasting USB swapping and fannying about.

    • @deeyadeli1435
      @deeyadeli1435 2 месяца назад

      You can send me the file as well just in case. Lol, jk.

  • @softwelveone
    @softwelveone Год назад

    Hi Naomi, Tom Sparks (another RUclipsr) spoke well of you so I recently started watching your video’s, man he wasn’t kidding, very well informed (and high quality) love your quad9 video and your videos on password managers… I recently ran across this new password manager called STASH PASSWORD (I am not paid by them, I’m just a regular paranoid internet user) I was really impressed by there product (alternative way of password management) but I’ve never seen any main stream RUclipsr do a review on them so I’m still up in the air about making the purchase. Would love to see an honest review on them!

  • @CeeMeeNYC
    @CeeMeeNYC Год назад +2

    Love your content. Thank you for helping us survive this Privacy/Security Jungle.
    One question, have you done any research on or have any good suggestions for the best privacy laptops? I use Linux at home and would like to move from my macbook to a linux based Laptop but am unsure about the security implications (broad options and preferences, but wondered if you had done any research on this topic?) Thanks again and keep up the encouraging work

    • @NaomiBrockwellTV
      @NaomiBrockwellTV  Год назад +2

      system 76 does a lot to remove intel spying, take a look at their offerings

  • @blogcorpo
    @blogcorpo 4 месяца назад +1

    Great video! ♥♥♥

  • @JohnSebeny
    @JohnSebeny Год назад +1

    +1 for Bitwarden

  • @collectorguy3919
    @collectorguy3919 Год назад +44

    As password manager vaults age, they become less secure as computer science advances. Lastpass did not increase the key derivation iterations for older vaults (it has to be done client-side), and those vaults are exposed now to brute force attack. I'd like to see an automatic vulnerability test & conversion utility, only requiring the users consent for conversion steps. That might be hard to implement across all platforms.

    • @babybirdhome
      @babybirdhome Год назад +6

      This right here is a crucial point in evaluating whether to stay with LastPass. I’ve been with them since the very early days, and thankfully I’ve always used a quite long and very secure master password, so although I was stuck with the old configuration for iterations, I’m still more secure than people who used less secure master passwords with the newer settings. But the fact that I’ve been a paying customer for all these years and this breach was the first time I was ever told about the change to the configuration is troubling to me. A browser extension or mobile app update should have popped up an alert telling me about that. Or the popup that shows up for insecure/re-used/breached passwords that pops up when telling it to fill in the login information on a page for the first time would be another good place to tell me that I’m using a no longer recommended critical security setting on my vault. That should have been done across multiple channels to ensure that customers were aware of the issue and the trivially easy fix for it.
      I have hopes that things will improve now that they’ve split the LastPass portion of the company off onto its own again after LogMeIn acquiring the company years ago, and am hoping this was just a bad timing thing. The nature of this particular breach is less concerning to me, even as a cybersecurity professional than many other breaches are, because they basically used information obtained in the previous and reasonably inconsequential breach to spearphish someone with extraordinary access to get access to the s3 bucket containing people’s encrypted vaults, and people are always the weakest link in any security chain, so that could have happened to any organization (and honestly does happen many times a day, every day). That by itself isn’t evidence of bad security practices, especially when you’re the biggest fish in the sea - just ask Microsoft. But the not telling users in a reliable way about the need to update their vault settings - that one counts, I’m afraid. That was poorly handled and is the primary reason I’m evaluating other options now after over a decade with LastPass.

    • @madtech2010
      @madtech2010 Год назад

      Couldn't increasing the password length offset the low key derivation iterations?

    • @collectorguy3919
      @collectorguy3919 Год назад

      @@babybirdhome Has any password manager provided the capability to upgrade (re-encrypt) old vaults under better security parameters? I'm not aware of any. LastPass just happens to be the largest target. Alerting won't do any good if average users are unable to act (if it's too hard), or if LastPass couldn't implement a vault upgrade utility across all platforms. Not excusing LastPass, but this might be non-trivial.
      Personally, I don't like one 3rd party handling synchronization for everyone. Too many vaults in one juicy target.

    • @collectorguy3919
      @collectorguy3919 Год назад +3

      @@madtech2010 Assuming you started out with a long random password, yes. If your password was "monkey123" then you can't change the data the adversary already has.

    • @davinp
      @davinp Год назад +1

      LastPass also did not encrypt all the data in the valut

  • @rst33079
    @rst33079 8 месяцев назад

    I really like your videos Naomi!

  • @ScrewballMcAdams
    @ScrewballMcAdams Год назад +1

    I dig the dance 😊. Thanks for the info.

  • @jmtx.
    @jmtx. Год назад +3

    Dealing with all the passwords has always been a royal pain. I don't trust any of the password keepers but it looks like things are getting out of hand but least you've got a good list of them here to look into. Thanks for the dance bit as well.

    • @ajbrady4357
      @ajbrady4357 Год назад

      What makes you not trust them? I Personally use 1Password and all of your account information is kept encrypted on their end at all times.

    • @jmtx.
      @jmtx. Год назад

      @@ajbrady4357 - Why should I trust any encryption method? Convenience is great but shouldn't lose sight of security.

  • @Richardj410
    @Richardj410 4 месяца назад

    Thanks for the dance, actually good food for thought.

  • @acidrazor
    @acidrazor Год назад +3

    Id also suggest getting a yubikey

  • @maxbarko8717
    @maxbarko8717 Год назад

    I am still using 1Password 6 which offers WiFi sync to iPhones and iPads (even with 1Password 7 on those devices). My local computers synchronize 1Password via NAS. Works great and I don’t have to pay a monthly fee.

  • @JeffRyman69
    @JeffRyman69 Год назад +2

    I use a password manager for web sites that don't involve financial information. For banks, credit cards, etc. I keep long random complicated passwords in an encrypted text file. When I need to log in, I decrypt the file, copy and paste the login information as needed, and then wipe the decrypted file.

    • @TON-vz3pe
      @TON-vz3pe 3 месяца назад

      That's the best way to do it. Trusting a password manager with financial site access is so dumb.

  • @duaneatnofroth
    @duaneatnofroth Год назад +3

    Hi Naomi! I love your content. I have a question about the fundraiser summaries that come with each video: Are they cumulative or per video?

    • @NaomiBrockwellTV
      @NaomiBrockwellTV  Год назад +4

      Per video. Each of our videos costs many thousands total to make, and we receive a small amount of donations on RUclips to help offset that

    • @duaneatnofroth
      @duaneatnofroth Год назад +3

      @@NaomiBrockwellTV Thank you for clarifying. I've always appreciated the transparency with which you operate!

  • @dr.c2195
    @dr.c2195 6 месяцев назад

    pass is a hidden gem. It works from the command line.

  • @CryptoDabber710
    @CryptoDabber710 11 месяцев назад +1

    I've been using different password managers like Bitwarden, Yoti, and hPass which is from Hacken a trusted Web3 security company founded in 2017. The 3 password managers above are the 3 that I've liked the most out of the different password managers I've used. I have been thinking about moving from a cloud password manager to a self hosted one. I know Bitwarden does have a self hosted option but I also prefer that hPass uses a generated seedphrase like a crypto wallet and is from a Web3 security company.

  • @juliar8806
    @juliar8806 Год назад +1

    You dont know how much i have waited for a video like this!😄 Ive used KeepassDx on my phone and one day i saw the file with all my passwords missing.. I suppose i might have deleted it by accident but i really doubt that.. Luckly, before knowing anything about privacy i stored some of my passwords on SamsungPass and they are still there, some of them.. Every since that incident im inclined toward using a cloud based PM but i feel like an offline PM would be a better over all privacy choise.

  • @draoi99
    @draoi99 Год назад

    I use passwords made from words in Irish Gaelic. So far so good.

  • @mhzprayer
    @mhzprayer Год назад +1

    Having and end-dance. Nice touch haha

  • @tnewdad
    @tnewdad 11 месяцев назад

    I enjoy KeePass - it is one of the only PW managers which can set expiration dates for passwords, as well as advance notification when an expiration is approaching. This was huge for me since I have many websites and databases that require password access - all with different expiration dates and varying lengths of time between resets. Now I get that advance warning and NEVER have a password expire and lock me out! Any inconvenience is far outweighed by this feature alone.

  • @chrisplusplus6232
    @chrisplusplus6232 Год назад +1

    informative content, thumbs up

  • @YannMetalhead
    @YannMetalhead 9 месяцев назад +1

    Great video.

  • @mentaldisease5193
    @mentaldisease5193 Год назад +2

    Also, consider crashes and breaks of your browser that forces you to reinstall ist. If you're lucky, the passwords stored in the built-in manager are still there, if not (e.g you decide to apply a clean uninstall and delete all data including configurations etc.), all your passwords are lost forever. Sure, this can happen to your external password-manager too, but honestly, this never happened to me in 20 years of using such software.

  • @GFTrooper1
    @GFTrooper1 Год назад +2

    KeepassXC and Yubikey only way to go! Very Good Video!!!!

  • @wholeNwon
    @wholeNwon Год назад

    Glad I subscribed.

  • @Aranimda
    @Aranimda Год назад +6

    Recommended password managers are secure until they aren't. LastPass was recommended by Steve Gibson (Security Now!) a long time ago. Recently they did an episode on how it was broken.

    • @pepeshopping
      @pepeshopping Год назад

      Steve DID have access to the code, but he was a fool by trusting that code access meant good code!

    • @Ultrajamz
      @Ultrajamz Год назад

      @@pepeshoppingthing is steve is one man. Bitwarden is open to every security expert to look at 24/7

  • @almoemason
    @almoemason 11 месяцев назад +3

    I use KeypassXC and I keep the Keypass data file on a VeraCrypt drive Both with a 16 digit randomly generated passwords using numbers, symbols and upper/lower case letters. Now my passwords are so secure not even I can get to them.

  • @nullx8
    @nullx8 Год назад +1

    very informative, and the strawberries keep the focus ;)
    i personally use 1Password due to its reputation and the Family/team features which allows extremly complex passwords to be shared between all sorts of people on different levels of tech usage, which makes them stand out dramatically.

  • @randomhuman69420
    @randomhuman69420 6 месяцев назад

    can i just say, i love the end dance

  • @voogarix
    @voogarix Год назад +1

    Thanks for the video and the dance))

  • @WickedMuis
    @WickedMuis Год назад +2

    The dance was a funny bonus xD

  • @kead6636
    @kead6636 Год назад +1

    Hi Naomi, with the announcement of Proton Pass. Do you think it would be worth considering as a password manager? Would it be as secure as the ones you mentioned here? Or would it be putting too many eggs in one basket?

  • @TIOLIOfficial
    @TIOLIOfficial 4 месяца назад +3

    22:15 - Yay, The End Dance!

  • @Alex-hv3ir
    @Alex-hv3ir Год назад +6

    What about apple’s keychain? I don’t know if I missed a video but how secure is it? How does it share passwords? How does it work?
    Because convenience wise it’s amazing, it auto syncs, creates passwords, alerts you if your password has been breached, uses AI to tell you if your password is weak and all that kind of stuff.
    But not knowing how it works I’m really going head first into their “password manager”

    • @CaroAbebe
      @CaroAbebe Год назад

      The keychain doesn’t appear to be the problem. However, lately some iPhones got stolen in the US after someone watched the owners put their password in to unlock the phone. If anyone gets hold of the password to unlock this means the keychain is theirs as well. As a result, quite a bit of money got stolen from each individual victim. A secure third party password manager adds an extra layer of security due to the fact that you need an extra password access to the password vaults. And some offer additional features such as an extra secure key.

  • @mhzprayer
    @mhzprayer Год назад +1

    From browsing your merch I'm now pondering the idea of Dredd Pirate Roberts having a skyscraper headquarters...

  • @sicarioga676
    @sicarioga676 Год назад +1

    Thank you 😊😊

  • @Insightfill
    @Insightfill Год назад +2

    While I like the content, I'm especially glad I stayed to the end!

  • @bm2085
    @bm2085 Год назад +1

    Thank you for the video! Finally a topic where I'm already using one of the best solutions :) Do you plan to create a video about online file storage services? Like Google drive, Dropbox and similar. I'm curious how good/bad is the one I'm using currently. (Pcloud, Proton drive)

    • @NaomiBrockwellTV
      @NaomiBrockwellTV  Год назад +2

      Yep that’s the plan!

    • @bm2085
      @bm2085 Год назад

      @@NaomiBrockwellTV looking forward to it, and thank you!

  • @unTLDR
    @unTLDR Год назад +1

    Excellent

  • @natemarx4999
    @natemarx4999 Год назад +2

    We need more uploads, Queen!!!

  • @GarryGrowns
    @GarryGrowns Год назад +1

    Great video. Super content, very well presented. New follower here

  • @Ninja_Gaijin
    @Ninja_Gaijin Год назад +3

    I use vanilla Keepass since I only use on Windows, haven't tried KeepassXC but I hear it's almost as good (with added functionality of being cross-platform/OS). I used to use Lastpass a long time ago but I'm REALLY glad I stopped..
    Offline / Keepass just seems so much smarter. It's a little annoying not having it online but I'd rather offline only and less risks.

    • @dejavu5121
      @dejavu5121 Год назад

      KeePass vanilla is the most secure way to store your passwords and it has lots of useful plugins. And yes, you CAN make it online with synchronization. Furthermore, you can also protect your database stored in the cloud with additional secret key + strong master password. But secret key must be located only locally, in the cloud should be only database. And even if your cloud would be compromised and hacker even will know somehow your master password, without a secret key they have no chance. It’s the most secured way to use and store passwords. I’m an IT technician, trust me ;) All these Online password keepers like Dashlane and others only a matter of time when they will be compromised.

  • @stuartwaldrip9280
    @stuartwaldrip9280 Год назад

    I like Mr. Snowden's passphrase idea. I like to use the craziest anagrams I can find for the phrase I've chosen.

  • @NomadOutdoorAdventures
    @NomadOutdoorAdventures Год назад

    I have been using Enpass password manager and highly recommend it it’s an off-line password manager system although you can choose your own storage places to sync it to, but not with Enpass company by itself does not give you the option to store your vault on their servers

    • @_zerocool
      @_zerocool 9 месяцев назад

      I also use Enpass for the same reason