tl/dr:
1. Password managers are targets, but hardened against attacks and a net-gain in terms of security
2. Defense in depth is your friend when it comes to online security.
3. Biometrics are generally fine, but...
I'm sure most of you know more about password managers than I do. It certainly seems a password manager site is the proverbial honey hole for hackers. Cracking into the site would like getting the keys to the kingdom. I'd consider a password manager, but I think I'd want one that wasn't in the cloud. It seems better for it to reside in encrypted form on one of my devices. Less accessible to hackers and less of a target. Am I off-base in my thinking?
You're not wrong: password managers could be appealing targets for hackers (more on that in a minute). But the main threat isn't a password manager being hacked, it's using short, repetitive passwords across sites. Password managers help address that: they generate a true-random password with one click, and also automatically check for re-use across your various accounts. Re. the cloud piece, you're also not wrong that can increase the threat surface, but if you have multiple devices it also means you can actually keep them in sync. Most of security is a question of prioritizing what's the biggest threat, and for most people a password manager with some degree of cloud connection is the best choice for "improves my security and is also convenient so I actually use it."
Password managers are far from the only piece of staying secure online. Turning on Multi-factor authentication when it's available, turning on login notifications when available, cleaning out old accounts you don't need, etc., are all pieces of the puzzle. The highest priority for most people, though, is improving what passwords you use and a password manager is far and away the easiest way to make that happen. The link here is a nice rundown of things to consider in terms of online security, in rough order of priority:
https://synecdochic.dreamwidth.org/804912.html
Re. the honey hole part: good password managers are designed with their being a target in mind. They assume that threat actors will try to hack/crack them, and design their systems to limit what can be done with the data they have, extend the time that it will take to make that data usable at all, and put systems in place to know ASAP that someone is trying to access or has succeeded in accessing their systems. That's part of why you don't hear of them being hacked more than you do.
I use a journal book for the handwritten PW. I dont understand the technicalities or risks of cyber science so I just keep it simple. Double factor authentication for all banking and Medical stuff. PITA but safe, I think. The journal is about worn out and filled with crossed out and replaced PW.
For those that truly know, how good, safe, is the facial recognition in my two banking apps on my iPhone ? - thanks
Facial recognition is usually fine from a "can someone remotely access the app" standpoint...so long as you keep control of your physical device. If someone gets a hold of your phone they could use a picture of you to access it. I love biometric access for the convenience (I usually go with fingerprints, personally), but for banking I always use username/password, even on my phone.
Nope. That is very sound thinking that security professionals support. I like to recommend Keepass to folks. If you’re a linux user, pass and pmenu are excellent tools.
Really? 'cause all the security professionals I know and work with are strong proponents of password managers that sync securely across devices automatically, through secure cloud connections.
