Password Managers and Multi-Factor Authentication

Following last week’s article on password-related issues, here’s one that focuses on solutions.

Password Managers

A password manager is a software tool that acts as a vault for your passwords. It addresses the challenges of creating complex, long, and unique passwords for each account without requiring you to memorize them.
These tools typically include features like auto-fill suggestions, password generation, synchronization across devices, secure storage for credit cards, and encrypted notes.

Advantages: You only need to remember the master password for the manager itself. Strong, unique passwords are generated for every registration, and everything is easily accessible across all your devices.

Two-Factor Authentication (2FA)

Another security layer involves adding a third verification step:

1. Username/ID (declaring who you are).
2. Password (proving you know the secret linked to that ID).
3. A secondary element—something only the account owner receives or generates separately from the service being accessed.

The most common method is Temporary One-Time Passwords (TOTP), which are typically 6-digit codes valid for seconds or minutes. These codes can be sent via SMS, email, or generated by an authentication app.

Note: Using an authentication app (e.g., Google Authenticator, Authy) is preferable, as SMS and email can be intercepted.

Comparison: Password Managers

For mobile use (Android/iOS), we evaluated usability while accounting for system limitations, poorly designed apps, and software-specific issues (e.g., failing to detect login fields, requiring manual copying of credentials).

Detailed Reviews

1Password

• Excellent ergonomics for beginners, with practical refinements (e.g., pop-up alerts for unknown logins).
• Allows password/note sharing with guest accounts (for businesses), shared vaults, or secure links for non-users.
• The company is Canadian but complies with US laws (under the Cloud Act), meaning data can be shared with US authorities without user notification.
• Good value for money.

Bitwarden

• Strengths include multi-domain credential management (using one account across multiple sites or different logins for the same site).
• Pre-configured lists for sites with multiple access points (e.g., Facebook + Messenger, Apple + iCloud).
• Official servers are in the US, but it’s easy to self-host.

Dashlane

• Generally satisfactory but lacks advanced features (no custom fields, limited sharing with non-users, rudimentary multi-domain support).
• User experience is inconsistent (clean UI but missing translations, pre-loaded accounts that malfunction, etc.).
• Data is hosted on Amazon (subject to US laws), yet it’s one of the most expensive options with no extra perks.

KeePassXC

• Excluded from the comparison as it targets advanced users: no built-in browser extension (though third-party options exist) and lacks sync/sharing features.

Proton Pass

• A newcomer with some early-stage flaws but evolving rapidly. Given Proton’s track record (e.g., ProtonMail), we expect steady improvements.
• Standout features for businesses, especially those subscribing to Proton’s full security/collaboration suite.
• Swiss-based, with a strong commitment to privacy.

TOTP Apps

This will be covered in a future article.