33Backpack33

For the average person it's best they use a cloud password manager as they're not responsible enough to do their own backups of a local password manager.

You could do that salt and pepper thing found here: https://passwordbits.com/salting-passwords/

This way you don't store your full password in your password manager.

As far as I can tell Bitwarden doesn't inject any scripts. I know people complain it doesn't have that overlay like LastPass has but Bitwarden not having might be a plus now.

The original VICE article said it was $16 and they can take as many accounts as they want. It seems worth it to me.

You do know uber and doordash accounts are hacked all the time because of password reuse? There is a huge black market for hacked accounts from doordash and the like.

Not when script kiddies already have free tools like this https://vimeo.com/308709275

If we all agree it's not secure then why do we keep using it?

I rather have a unique password then rely on SMS anything especially if that account allows you to reset your password by SMS.

username + unique password would be better than all the other options listed.

Adding SMS seems to add new points of attack that either hurt the user or just delays the hurting.

When you consider SMS 2FA is often used to fix the poor or reused password problem we see it's not helping much at all but only delaying the problem.

It doesn't stop it but delays it. The attacker seeing a SMS 2FA screen doesn't mean they give up, it just means the user is now more valuable. This explains it https://passwordbits.com/dont-need-sms-2fa/

This article goes more in depth and answers the questions you bring up https://passwordbits.com/dont-need-sms-2fa/

This article does a better job of explaining how SMS 2FA doesn't solve the credential stuffing problem. https://passwordbits.com/dont-need-sms-2fa/

Nothing more lazy than doing something like generate a password for the user. The way most browsers work you have to go out of your way to not let it save and fill passwords.

If you create the password for the user they can't reuse it and thus no credential stuffing problems.

If they made it that far to get your password why do they need to log into your account? Having multiple locks on your door don't matter if they got in through a window.

The paper also said, "websites should eliminate SMS based MFA altogether".

If it's nothing new then why do people keep saying it's better to have SMS 2FA then to not have it. The research says "websites should eliminate SMS based MFA altogether".

So can we finally stop saying it's better to have SMS 2FA then to not have it?!

Report for child labor!

I find a password manager is more than just for passwords. I store PIN codes, Code, security questions, important notes, and so many other things.

It's too expensive for what it does and don't trust it mostly from its auto password changer does it on their servers.

Isn't most OS's now blocking read access to text fields labeled as "password"? I'm pretty sure MacOS does this now.

I've confirmed it because you can see the data that the web browsers sends and it was encrypted. I've also tested this on LastPass and Bitwarden and from what I can see 1Password does it the best.

Can we not submit to Google to shut down for spreading malware or get the domain registrar involved?