How are you storing passwords and 2FA keys that proliferate across every conceivable online service these days?

What made you choose that solution and have you considered what would happen in life altering situations like, hardware failure, theft, fire, divorce, death?

If you’re using an online solution, has it been hacked and how did that impact you?

  • jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    4 months ago

    Seconded, plus hardware keys with passkeys disabled. Depending on your threat model, you might want your hardware keys to be a second factor, not a replacement for all the other factors. Passkeys do not fit into my threat model, as they are implemented as identity and password replacements rather than supplements

    Bitwarden has an emergency contact who can access a vault after 2 weeks if you don’t deny it.

    https://github.com/cyphar/paperback is great for a printed analog option as well. You could put your vault key into a multi paper printout, distributed amongst trusted people, so you need a quorum of them to get your secrets if you’re gone. Or get access to the family Google photos library, or whatever

    • Mike Wooskey
      link
      fedilink
      English
      arrow-up
      3
      ·
      4 months ago

      Thirded. I self-host it (actually the Vaultwarden fork) and use it on desktop browsers, as a desktop app, and as and Android app (F-Droid). I also store secure notes in it (e.g. end of life instructions for my partner). Very powerful and versatile, and AFAICT, secure.