I recently switched from 1Password to Vaultwarden and decided to manually migrate each of my entries rather than moving everything over with an export file. The primary motivation for this was to perform an audit of all of my accounts — ensuring I had a good baseline level of security for my logins.

I’m, by no means, an expert in security, but think I have a pretty decent understanding of how to secure my accounts. If you haven’t taken the time to improve this component of your digital life, here are some suggestions of what you could do on that front.

1. Use a Password Manager — This will have the biggest impact on the security of your accounts. And although it seems pretty obvious, it’s worth mentioning on the off-chance anyone reading this isn’t already using one. With a password manager, you’ll just have to remember your master password and then you can let it do most of the heavy lifting for you — it can generate randomized passwords, store credentials, automatically fill in login details using a browser extension or system-level integration on mobile, and more. You can use Bitwarden or Proton Pass which offer free plans, self-host with Vaultwarden, or go with something like 1Password. But you should at least be using something.
2. Consider Deleting Accounts — If you still have an account for a service that you no longer use and are unlikely to ever return to, it’s probably a good idea to just to delete the account. As long as you’re already using a password manager with randomized passwords — you’re not re-using passwords — you don’t have to worry about the service having a security incident that puts your other accounts at risk. That’s not what deleting the account is about. Instead, you’re reducing the exposure of your email address and any other personal details that the service may have about you.
3. Update Account Email Addresses — If you’ve switched email addresses over the years, you may have some old accounts that are associated with an email addresses that you no longer have access to or simply don’t want to use anymore. In my case, I used to use Gmail and eventually migrated to using an email address with my own domain through Fastmail. Even though I have Gmail setup to forward messages to my current email address, I’d prefer to no longer use Gmail at all. So for any account that still uses Gmail, I’m slowly switching the associated email address to my current one.
4. Enable Two Factor Authentication for Accounts — If you’re using a password manager, it may very well offer a reports-type feature that will list all of the accounts you have that support two factor authentication where it doesn’t appear to be enabled. Vaultwarden and 1Password both offer this, for sure. Two factor adds an additional layer of security to each of your accounts, which will help prevent malicious actors from gaining access, even if your password becomes compromised.
5. Improve Weak Passwords — Another item that your password manager should be able to help with. Ensure you’re using sufficiently strong passwords to prevent brute force attacks.
6. Check for Missing Backup Codes — If you have an account with two factor authentication enabled, the service most likely offers backup codes that can be used in case you lose access to your authentication app. If you don’t have these backup codes saved, you risk getting locked out of your account.
7. Store Backup Codes Outside of Your Password Manager — It’s easy to drop these codes into the notes section of your password manager, but it’s much better to store them in a separate location. You could save them on a thumb drive and/or print a physical copy and keep those items in a fireproof safe. Perhaps even in a safe at a close friend or family member’s house. Just make sure they aren’t exclusively stored in the same place as where you’re generating two factor authentication codes, which would give you a single point of failure.
8. Move Two Factor Authentication to a Separate App — I recently polled my followers on Mastodon and the plurality of respondents just use their password manager to generate two factor codes. It is much more convenient and most password managers offer the feature. But it does come at the cost of some security. If you want to go above and beyond in securing your accounts, you can generate your two factor authentication codes using a separate app. I’ve heard good things about Ente Auth and 2FAS — if you wanted to go down this route, I’d start with one of those.
9. Setup an Emergency Plan — How could you ensure that someone else had access to your accounts if something happened to you? It’s not pleasant to think about, but it’s something that has to be considered at some point. Bitwarden offers an Emergency Access feature for just these circumstances, but another option would be to share the login credentials of your password manager with your spouse or a family member that you can trust.
10. Consider a Backup Solution — This is more applicable for those that are self-hosting their passwords and less relevant for cloud-based solutions. But may be worth the trouble if you wanted to prepare for the unknown. I don’t have any specific recommendations for how to store those backups, but taking into consideration the 3-2-1 backup guidelines — three copies, two different storage media, one being offsite — is a good start. And given how sensitive the data is, be sure the backups are encrypted. Your password may offer the option to encrypt an export file or you could encrypt it yourself with another tool — Bitwarden has some information about this that may be useful.

David Heinemeier Hansson:

The problem with passkeys is that they’re essentially a halfway house to a password manager, but tied to a specific platform in ways that aren’t obvious to a user at all, and liable to easily leave them unable to access of their accounts. Much the same way that two-factor authentication can do, but worse, since you’re not even aware of it.

Passkeys have become a requirement for logging in to one of our accounts at work and I’m not a fan at all. I have it saved in 1Password, so I can use it across all of my devices. But if there was ever a need for me to login on a device that doesn’t have 1Password installed, I’m not even sure how I would login at all.

I actively avoid enabling passkeys for any of my other accounts, instead opting for strong, randomly generated passwords combined with standard two-factor authentication when available.

➝ Source: world.hey.com

With the introduction of 1Password’s Safari extension, they’ve also discontinued their share sheet extension. This has managed to irritate quite a few users, including myself.

While the Safari extension is great, it doesn’t replace all of the functionality of the previous share sheet extension. Here are a handful of examples off the top of my head:

• No way to auto-fill non-login data in third-party browsers or within a Safari View Controller, such as credit/debit card information.
• Improperly designed login forms don’t work with the system-level auto-fill feature.
• Applications that implemented a 1Password-based auto-fill system using the share sheet, often times using the 1Password logo, display nothing in the share sheet.
• Users that still have iOS 14 installed don’t have access to the new Safari extension, leaving them out in the cold for a lot of auto-fill features, even in Safari.

It’s not great. And to make matters worse, there doesn’t seem to be a good reason for it’s retirement.

Dave Teare, writing about the decision in a comment on Reddit:

Now I can definitely see how you could want us to continue postponing the share sheet’s retirement. We’ve postponed it for a few years already so why not another year or two? We could have done that but maintaining three different features that all serve the same purpose (Password AutoFill, share sheet, and now the new Safari web extension) is a big ask. Something had to give and since the share sheet offers the least functionality that isn’t covered by the other two it was time to bid it adieu.

Okay, fair. But in the previous paragraph he wrote the following:

We did however stop maintaining it as it was becoming quite long in the tooth.

So if they had already stopped maintaining it, the claim that it would require additional work to maintain doesn’t really hold water. The sensible solution would have been to keep the share sheet extension in the app for some period of time alongside the Safari extension and then notifying users of its imminent retirement.

What irritates me the most is the lack of messaging. I had no idea the share sheet extension was even in consideration for retirement. One day I just updated the app and it was gone — it wasn’t even mentioned in the 7.8 release notes. At first, I thought there was some bug in iOS 15 causing the issue because I had updated around the same time it disappeared.

I’ll get used to launching the app and copy and pasting into Firefox, Safari View Controllers, and so on. But if I knew that this was going to be the case before it happened, it would have softened the blow a bit. The takeaway to all developers, if you’re going to be taking functionality away from users, at least let them know in advance.

This is a great suggestion from the folks at The Sweet Setup. I’ve actually had this idea bouncing around in my head recently and I’m glad to see someone has done the legwork to figure out the best way to do this.