I was gonna ask about the biometrics part in a separate question, but its both about security, so might as well combine it in one post.
Okay so I don’t use password managers. I just try to make easy to remember passwords 3-4 random words + 3-4 random numbers. Online accounts can’t be brute forced anyways. Edit: I mean most websites have log in limits don’t they? Maybe I’ve been mistaken?
For offline accounts, I just increase the words and numbers. For mobile I don’t use biometrics, although I’ve been testing whether or not I want a pin + no biometrics or alphanumeric password + biometrics. I just can’t decide.
I use the password manager Bitwarden, but Proton Pass is looking kinda nice.
Same with bitwarden, I recently made my wife change from google because I don’t trust how they could be managing that kind of data.
What benefit could it be to Google for them to have access to your user and passwords?
Genuinely curious, I use bitwarden myself but can’t see Google using their password manager for nefarious reasons
Sure, probably they won’t use it for bad purposes.
But there’s nothing saying they won’t use them in any way they see fit.
Maybe they could find a way to find monetize without disclosing them and anonymized, like statistics or with the update in their policy about training their models with whatever information they can get.
Maybe you have an ad blocker and AdSense can’t build a profile from you, but the google already know what sites you were interested enough to make an account and could try to advertise in other ways.
And then the biggest issue: there’s no mention of encryption, so who knows how they store them and where. Could an attacker read them? How are google employees prevented from reading them?
Whats the reason proton pass is looking better? I just started my switch to bitwarden, I used to use enpass offline on windows.
Open sourced password manager + open source 2fa wherever available. For password managers many will suggest Bitwarden & i recommend that to my family for its ease of use, though I personally use Keepass (because it allows me to store multiple documents & have them readily available offline. Its not as straightforward to set up sync compared to Bitwarden, which does it by default).
I would never allow a browser to store any information such as passwords, credit card info etc
On mobile I use password in conjunction with biometrics. Sensitive apps are only ever stored inside secure folder which has no biometric access & has a different password to main area of phone.
I absolutely refuse to use google/apple/samsung pay.
Please consider password manager, once you wrap your head around not knowing any of your passwords except the strong master password it becomes second nature. Get out of the pen & paper habit!
Top tip. For any new signup, once you’ve generated a strong password make a note within the password manager of the email address you used to sign up with (yep, get used to using multiple email accounts). When that site inevitability suffers a data breach it makes life easier when they send the change of password verification email
I write my passwords down using a diamond-point scriber on a tablet of solid gold, which I keep in a secure location.
Online accounts can’t be bruteforced
I’m sorry, but that’s just wrong.
Majority of sites have awful security practices, not to mention massive breaches.
Get yourself either a password manager (Bitwarden is the best), or something like Yubikey + unique sentences.
Biometrics do not provide security, they’re purely for convenience.
I run my own instance of vaultwarden (100% compatible fork of bitwarden) and use the standard bitwarden client on Android and browser plugin in Firefox. My master password is really long and I use 16 character passwords as standard in BW. I have biometric set up for my phone just to make it a bit less hassle.
Edit: and I set up MFA wherever possible with a yubikey
