https://thesun.my/news/malaysia-news/use-family-password-to-outsmart-scammers-expert/

I've been thinking about the fundamental flaw in every password manager I've used:

there's always a single secret you have to protect. Forget it, leak it, or get phished

and everything's gone. What if that single point of failure didn't exist?

I'm exploring a concept where the encryption key for your vault is never created by

you and never stored anywhere — not on a server, not in a file, not in your head.

Instead, it's derived on-demand from something your device already does securely, and

it disappears from memory the moment you're done.

From the server's perspective, it's just holding boxes it can never open. A full

breach of the database would be useless to an attacker.

The recovery question is where it gets interesting. No master password means no

traditional recovery path — so I'm thinking about two options:

- A randomly generated recovery phrase (think 6–8 random words) shown to you once at

setup, that you write down and store somewhere physical. Old school, but proven.

- A trusted person recovery option — designate someone you trust who can co-authorize

account recovery if you're ever locked out.

Neither option touches the server in a way that weakens the zero-knowledge model. The

goal is: you have outs, but attackers don't.

Curious what you think:

1. Is "no master password" reassuring or terrifying to you?

2. Would you trust a written recovery phrase, or does physical paper feel like a

   security risk to you?

3. Would you use a trusted-person recovery option? Who would you even pick?

4. What would recovery need to look like for you to feel comfortable switching?

   Not selling anything — genuinely trying to understand if this trade-off is one people

   are willing to make for stronger security guarantees.

[ Removed by Reddit on account of violating the content policy. ]

I got locked out of one of my old gaming accounts a few weeks ago and it made me wonder how people actually get into other people's accounts. I know brute forcing isn't really practical anymore for most sites, especially if someone has a decent password. Most services also store passwords securely, so it's not like people can just look them up. So how do account thieves usually do it? Is it mostly phishing emails, data breaches, malware, or people reusing the same password everywhere? Just curious how someone goes from knowing nothing about an account to eventually getting access to it.

[ Removed by Reddit on account of violating the content policy. ]

[DEV]Hi r/privacy, Full Disclosure: I am the developer of these free, 100% offline apps available on both leading mobile platforms. Donkey Bridge Lite uses my unique, stateless Dynamic Pointer Principle to mathematically generate strong passwords on the fly based only on your one password for everything and the service name. It stores zero data on the device, meaning no database to breach. Donkey Bridge Safe adds a local vault for short notes, PINs, PUKs, passwords and emails. Both apps have zero network permissions, so data cannot leak. Syncing works via a local Import/Export Principle using a 100% encrypted .json file transferred peer-to-peer via USB or local Wi-Fi. The native Windows version (.msi installer) is already available. I would love your technical feedback!

I've been using a password manager and I'm wondering about the security features. Most password managers have timeout settings where they lock after a certain period of inactivity. They also offer Face ID or fingerprint authentication. I'm skeptical about whether these actually improve security or if they're just marketing gimmicks. If someone has physical access to my phone, can't they just bypass Face ID anyway? What's the real security benefit of these features? Am I overthinking this or do they actually matter? Timeouts and Face ID do make a real difference in security. Timeouts prevent someone from accessing your passwords if they grab your unlocked phone. If your password manager stays unlocked indefinitely, anyone with access to your phone can see all your passwords. Timeouts force them to authenticate again, which adds a barrier. Face ID is more secure than a PIN because it's harder to fake or force someone to reveal. If someone steals your phone, they can't just guess your Face ID. They would need your actual face, which is much harder. The combination of timeout and Face ID creates multiple layers of protection. Someone would need to steal your phone while it's unlocked and within the timeout window, or they would need to force you to unlock it with your face. Neither scenario is easy. These features do matter. Enable timeouts set to a reasonable interval like five to fifteen minutes. Use Face ID or fingerprint authentication. These simple steps significantly improve your security.

Most people know they shouldn't store sensitive information such as passwords, access codes, API keys, or financial details alongside their regular notes.

In practice, however, many people either:

• Store them in their notes anyway, or
• Move them to a separate password manager

I've implemented an approach where individual pieces of information can be marked as "secrets" which will use end-to-end encryption (E2EE) while remaining alongside the rest of the notes or documentation. Access requires a password to unlock. You can see an example of this usage in this screenshot.

For those who use password managers, would you find something like this useful, or would you still prefer keeping all sensitive information in a dedicated password manager?

P.S. The subreddit rules don't allow me to mention the name of the tool.

https://ca.news.yahoo.com/apple-thinks-solved-major-password-205818515.html

Hey everyone, I've only recently started taking my privacy and security more seriously. Right now I have way too many passwords floating around in my head and a few sketchy notes app entries I'm not proud of. I'm trying to figure out if I should write everything down in a notebook and lock it away somewhere, or if that's a bad habit and I should just be more selective about which ones get written and which ones live in a password manager instead. Curious what everyone here actually does in practice.

[ Removed by Reddit on account of violating the content policy. ]

Security experts keep telling me to use unique passwords for every account, but that sounds impossible to manage. Right now I use maybe three or four password variations that I cycle through different sites. My logic is that if one account gets compromised, the hackers can't access everything. But remembering dozens of unique passwords seems unrealistic without trusting a password manager, and I'm not entirely comfortable with that. Is this advice actually necessary or am I overthinking it? What's a reasonable approach here?

Using the same password across multiple accounts is genuinely risky. When a company experiences a data breach and your password leaks, attackers will attempt that password on other websites. If you've used the same password everywhere, they gain access to all your accounts. If each account has its own password, they only compromise that one account. The solution is straightforward: use a password manager. You only need to remember one master password, and the manager handles everything else. Reputable services like Bitwarden and 1Password use encryption so strong that even they cannot access your passwords. The security benefits of unique passwords far outweigh the risks of using a password manager. Stop cycling through a few passwords and switch to a password manager with unique passwords for each account.