Hacker News Reader

Comment by sfdlkj3jk342a | Hacker News Reader

That's what a username and password are for. I'd rather not be forcibly tracked.

I have 200+ different passwords stored in iCloud Keychain, each 20+ characters long. How am I supposed to remember all of those?

Do you use the same password on every site? How do you deal with data breaches?

You can just use your own password manager and it wouldn't automatically do anything to apps on reinstall, right? Or a physical notebook, maybe.

I’d love to have my own password manager that syncs between all my devices without relying on a third party server, but I don’t know of one. Do you?

A physical notebook is so easily lost I wouldn’t even consider it.

I use KeepassXC and Syncthing. It's not a single password manager doing both the managing and syncing, but it works very well, and I sync between phone/laptop/desktop without any third parties.

Do they work on iOS?

Keepass database is an openly documented format, and there are several apps available on iOS that use it and can store the database in your iCloud (ie syncthing is not required, unless you need to sync to non-iOS devices)

Just search for keepass in the app store (Keepassium, KeePass Touch, Strongbox, ...)

I see there are a lot of Keepass apps in the App Store. How do I trust the developers not to steal my credentials though?

I don't know about iOS but if it saves it to your Files and lets iOS deal with the synchronisation then it should not have any network permissions?

(I use KeePassDX from F-droid it does not have network permissions)

Great name.

Frank Dux was a fraud! :)

Major reason I don't use password managers that much.

> Do you use the same password on every site?

I use a password I can reconstruct in memory for sites I care about logging in by hand. If I don't, or don't mind resetting my password each time, I just use random garbage + whatever platform password manager is the one active today, with vague hopes that it'll still be there the next time I need to log in.

> How do you deal with data breaches?

Who ever cares about those? I'm yet to hear about anything impactful being released on those. It only matters if you actually do reuse the same e-mail/login and password combinations on both important sites and garbage sites. Which is something you should not. But 2FA and magic links tend to solve that vendor-side, these days.

Reply on news.ycombinator.com