OneLogin Users - They've Been Hacked

[asmo]

Repeat after me: Do not use cloud based password managers. All cloud based password managers are evil. If you must use a password manager, it needs to be locally resident and not on someone else's computer.

[Grant H.]

Repeat after me: Do not use cloud based password managers. All cloud based password managers are evil. If you must use a password manager, it needs to be locally resident and not on someone else's computer.

This.

I have a text file on an encrypted NAS that I can access from anywhere that I use to keep obscure passwords written down. Even then, I don't write the password out, I just give myself a text based hint/clue as to what the password is.

Example:

Site: XYZ.com
Username: abc123
Password: Password 1, first Cap, Last cap, + SC1 and SC2

I have used the same 3 passwords, with dozens of variations for years. I've never had a password get "hacked".

Works great, and the security level is fantastic. Someone manages to breach my personal network (highly unlikely), then crack the 256-bit AES encryption on the NAS (extremely unlikely), and then guess my passwords anyway...

[Jer]

Repeat after me: Do not use cloud based password managers. All cloud based password managers are evil. If you must use a password manager, it needs to be locally resident and not on someone else's computer.

I couldn't agree more. The admins that think they're making the world safer by forcing frequent password changes and specific characters that require users to then use a 3rd party host to track all of their passwords are actually creating more problems. All my passwords are in my dome and I sleep tight at night knowing that nobody has them but me.