Password Managers?

AdrianH said:
I prefer Authenticator Plus that offers choice of cloud storage providers for backup and syncing purposes. I have yet to find something else that offers this.
Click to expand...

Technically that super open source one, I think KeyPass or something similarly named let’s you drop the database anywhere you like.
 
SauRoNZA said:
It’s very quick and painless to export from one password manager into another.

Haven’t done LastPass to Bitwarden specifically, but done a few others into Bitwarden without issue.

Couple of minutes of effort.

****

You can load Microsoft account, the only compromise is that you lose the prompt option.

But the Microsoft Authenticator also offers backups so you are sort of half way there.

Bitwarden actually has built-in 2FA support but I’m yet to try it out.

From a security point of view I’d prefer to keep them separated anyway.
Click to expand...
I switched yesterday from Lastpass to bitwarden and it was a smooth transition, with Authy its a perfect combo.
 
Pineapple Smurf said:
Google Chrome because it is free
Click to expand...

I had my passwords on google chrome and got hacked… as far as I can see they got access to ALL my passwords. I was changing my password to IG every day because my hacker logged in and would change it again (they could no doubt get the new PW by checking my chrome!) . Then they got my Netflix PW… so now I have Bitwarden and am changing everything!
 
Thinking about it, my biggest issue is getting my 40 odd TFA tokens into Authy or similar. Really don't want to have to disable and enavled each account one by one just to get them into Authy.
 
AdrianH said:
Thinking about it, my biggest issue is getting my 40 odd TFA tokens into Authy or similar. Really don't want to have to disable and enavled each account one by one just to get them into Authy.
Click to expand...
And if you lose your current device, what then?
 
SueC said:
I had my passwords on google chrome and got hacked… as far as I can see they got access to ALL my passwords. I was changing my password to IG every day because my hacker logged in and would change it again (they could no doubt get the new PW by checking my chrome!) . Then they got my Netflix PW… so now I have Bitwarden and am changing everything!
Click to expand...
I have just downloaded Bitwarden, Thank You
 
Speedster said:
And if you lose your current device, what then?
Click to expand...
As I said, I use Authenticator Plus which has multi-device syncing by using cloud storage. Even then, as mine is backed up in Dropbox, I can just install app on another device, link it up to Dropbox, and enter the master password for it to sync.

My concern is just that the app hasn't been updated since December 2018 which is my concern, I think developer has gone awol.
 
AdrianH said:
Thinking about it, my biggest issue is getting my 40 odd TFA tokens into Authy or similar. Really don't want to have to disable and enavled each account one by one just to get them into Authy.
Click to expand...
Why? If you’re backing up the secret then all you’d need to do is create a QR code with the secret and scan it.
 
DA-LION-619 said:
Why? If you’re backing up the secret then all you’d need to do is create a QR code with the secret and scan it.
Click to expand...
I can export them into text. Are you saying I can create a QR code for each one? Is there a tool you know of?
 
AdrianH said:
I can export them into text. Are you saying I can create a QR code for each one? Is there a tool you know of?
Click to expand...
There’s a Notepad++ plug-in.
github.com

GitHub - vladk1973/NppQrCode: Notepad++ plugin allows to create QR-Code from selected text

Notepad++ plugin allows to create QR-Code from selected text - GitHub - vladk1973/NppQrCode: Notepad++ plugin allows to create QR-Code from selected text
github.com github.com

The TOTP format for the QR code should be like below.
Code: 
otpauth://totp/{service}:{username}?secret={base32-encoded-secret}&issuer={issuer}&algorithm=SHA1&digits=6&period=30

You’ll know you’re on the right path if your current app and Authy display the same code.

Speedster said:
And if you lose your current device, what then?
Click to expand...
This is why the backup codes are important. Almost no service will remove 2FA from your account even with a password reset.
It’s always a human involved process that takes weeks.
 
Last edited:
SueC said:
I had my passwords on google chrome and got hacked… as far as I can see they got access to ALL my passwords. I was changing my password to IG every day because my hacker logged in and would change it again (they could no doubt get the new PW by checking my chrome!) . Then they got my Netflix PW… so now I have Bitwarden and am changing everything!
Click to expand...

Anything can be hacked if your master password was dumb.

It’s not the service at fault.

Also, why didn’t you have 2FA? Password Managers are pointless without it.
 
AdrianH said:
Thinking about it, my biggest issue is getting my 40 odd TFA tokens into Authy or similar. Really don't want to have to disable and enavled each account one by one just to get them into Authy.
Click to expand...

Why disable each account?

Just add another factor with Authy in slow time as you use things.

Better yet, get a Yubikey.
 
SauRoNZA said:
Why disable each account?

Just add another factor with Authy in slow time as you use things.

Better yet, get a Yubikey.
Click to expand...
The only way to get the TOTP secret in plaintext is to disable and re-enable, unless you’ve stored them in plaintext which is normally not the case.
Even if you were to move from Authy to Yubikey you’d have to follow the same process, but since the secrets are now on the Yubikey(not the blue security key) if you lose the Yubikey you can’t generate codes.

The factors since I last checked are:
Something you know
Something you have
Something you are

You can combine them up anyway you like. Changes to FIDO etc. Have slightly complicated things with the introduction of residential keys to enable passwordless flows.
 
Last edited:
DA-LION-619 said:
The only way to get the TOTP secret in plaintext is to disable and re-enable, unless you’ve stored them in plaintext which is normally not the case.
Even if you were to move from Authy to Yubikey you’d have to follow the same process, but since the secrets are now on the Yubikey(not the blue security key) if you lose the Yubikey you can’t generate codes.
Click to expand...

Yeah but what I mean is he doesn’t instantly need to dump the old app or disable anything.

Just add another 2FA option in slow time as you log into services. Next thing you know they are all moved.
 
SauRoNZA said:
Yeah but what I mean is he doesn’t instantly need to dump the old app or disable anything.

Just add another 2FA option in slow time as you log into services. Next thing you know they are all moved.
Click to expand...
AFAIK you can only have one TOTP option, I haven’t come across any service with two or more.
 
Speedster said:
Nah, you can have the same code activated on unlimited devices / apps.
Click to expand...
Yup, one secret. The secret is trusted not the device or generator.
Once confirmed in that QR scanning process, the secret will never be shown again to you.
 
DA-LION-619 said:
AFAIK you can only have one TOTP option, I haven’t come across any service with two or more.
Click to expand...

I have multiple TOTP/2FA/FIDO options on most of my accounts.

Some of them don't allow more than one for sure, but it's a minority.

I generally can login with TouchID first, then Yubikey failing that and then TOTP as a last resort.

****

Oh and the old SMS/Email option as well of course.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X