(untitled)

Hey Lain, what password manager do you use? And why? I'm currently using KeepassX[1] and considering switching to KeepassXC[2], which actually seems to still be maintained. XC should be familiar enough and it has a pleasant interface. However, it's also fairly niche, doesn't appear in any repositories, etc. I kind of fear this hypothetical scenario where my computer crashes and I'm setting up a new install, only to find that the password manager I use has died in the fashion of truecrypt, and I'm left with somewhat shady downloads to supposedly the last binary hosted on some russian shareware site. And I just have this mostly opaque file format containing my everything and no very trusted way of getting to the contents. So, driven by that fear, I've also strongly started considering pass[3], which is just a fairly simple wrapper around GPG and mostly a standardization of how to store passwords with GPG, considering that there's a ton of alternative clients for pass that don't really share any codebase. At least here I don't have to fear that GPG of all things is going to vanish any time soon. It's also more alive than KeepassX, but I will have to change around my workflow quite a bit. So, how do you manage your passwords? [1]: https://www.keepassx.org/ [2]: https://keepassxc.org/project [3]: https://www.passwordstore.org/

The original KeePass is still well maintained, and it's open source. You can run it through mono or wine, or you can just rest assured that if KeePassX goes under you'll still be able to recover your passwords. I can't see how the scenario you envisage couldn't also happen to any other password manager to be honest, or to GPG.

>>1219 I'd rather not run the original keepass, I try to keep my system free of Mono. And I don't think it will help in a "rescue" operation because the original uses a different file format now: kdb vs kdbx. And yeah, it could conceivably happen to *anything* but we're talking probabilities either, and I don't think the odds are very big of all implementations of PGP vanishing.

>>1220 Fair enough; you can still run it through wine which is known to work, but it's still a .net program so I'm not sure how you think about that I've not used it but pass looks like a fine password manager, it looks as close to what you want as can be (free software, well maintained). If you can slowly migrate or at least put a lot of effort into a seemless migration, your workflow shouldn't be too badly disrupted.

>>1218 just a notebook for some of them and firefox for most of them

I manage my passwords manually, I can actually remember over 50 passwords(about 12-16 alpha_numeric & special chars for each). Same goes for my credit cards, pin codes, social numbers etc. I'm really paranoid about this since I was a child, I guess I managed to train myself to remember. I even get anxiety attacks when I input a password not on a local machine which I and only I own. I change all my passwords every 2 months(sometimes 4 if I'm lazy) in a randomize script of some sort. I do keep a physical backup on a floppy sometimes in case I didn't have enough time to memorize. It's not a perfect method but I don't feel like synchronizing my passwords

>>1224 do you really use a floppy?

>>1221 >pass FTW also like that it has git integration, though rsync works too and can use multiple gpg keys for shared passphrases the password store is just a set of directories and gpg-ed files so I can always use pgp without pass if required.

>>1226 I know right? I love pass so much

Still using keepassx.

>>1225 I got a few usb floppy drives and an old laptop with a floppy drive. total amount of floppies I have is 21. 1 which is MS DOS

masterpassword, and I have about 5 different passwords memorized I like how it doesn't actually *store* the passwords anywhere, so if I ever have some weird simultaneous 5-drive, 2-computer failure I'll still have all my passwords

>>1232 same If someone else reading this decides to use masterpassword, you should also look into making a good master password to use for it with diceware. http://world.std.com/~reinhold/dicewarefaq.html

My brain usually tends to keep all the passwords for me. I don't trust password software.

>>1263 I actually do this, but I am noticing that my own memory starts failing me when it comes to a large quantity of passwords. I am just using KeePassX as a bit of a back-up in case I lose a critical password.

Wow never heard of keepassxc the totp support for 2fa is so nice. I’ll be moving from KeepassX to it. Since when did keepassX stop getting developed? And I’m assuming I can use my same database on XC right?

My own brain. With a few basic memory techniques, such as creating a story out of a randomly generated password where each letter and number means something, you can remember passwords of massive length. I have 128 character passwords memorized that way.

>>1268 yeah your database will still work. XC is really nice and I hope it continues to be developed although at this point what would it even matter if it didnt keep getting developed? Everything would stil work, only problem would be if a vulnerability was found. I kinda hope they add 2fa to open your databse if that's possible

LastPass, because it's a Google Chrome add-on and the backup is in the cloud.

>>1776 which means your passwords can get hacked and are at the mercy of LastPass....

Just encrypting a text file with gpg yourself would be more secure than Pass because it creates individual files with names of sites that you tell it which is a atrocious practice. I use keepassx because it's easy and i have been for years.

>>1220 There's still KeePass Classic in case you don't want to run managed code - they stopped development on that version though. I don't like .NET and Mono either.

What i like to do is keep my Passwords in an encrypted USB and keep a text document with the passwords

>>1787 Pic related? You should also keep other text files on the drive- also don't obviously mark your password file as well

>>1779 Vim has built in file encryption which might be more convenient.

>>1789 The vim help file says that the encryption was a weak type (zip | blowfish | blowfish2) and that a 6 character key can be cracked in a day . At least the one set using :X If there's a way to use pgp with vim plz post though, haven't had time to look yet

KeepassX is a rather simplistic C++ codebase. This is not like the Truecrypt case where it was reportedly a clusterfuck.

>>1230 This is actually a really good strategy if you can encrypt everything. 1) I know no one who owns a floppy drive 2) If I was robbing you or going through your bag I wouldn't touch a floppy disk

>>1796 >You can use the 'cryptmethod' option to select the type of encryption, use one >of these: > :setlocal cm=zip " weak method, backwards compatible > :setlocal cm=blowfish " method with flaws > :setlocal cm=blowfish2 " medium strong method

>>1796 http://www.vim.org/scripts/script.php?script_id=3645 may be what you're looking for. Haven't used it myself; just googled it out of curiosity after reading your post

>>1796 GPG is better but blowfish2 isn't weak

>>1803 great until some shavings get stuck inside the floppy enclosure and tear up the disc. Or god forbid something be inside the disc drive. there's a reason the design was retired.

>>1833 >Talking soykaf about floppys http://www.bbc.com/news/world-us-canada-36385839

>>1834 Yeah... That article does nothing to help your argument

>>1788 How do you get the combo-lock usb in that picture lol?

>>1218 Alphanumsymbolic 40-char, stored directly in the synapses of my spinal cord. I remember passwords that I don't use anymore which is like kicking dead whales down the beach. I've got a question about kdb (keepass database files). Can I store plaintext info in the comments of some of these securely? Like, I've gotten some of my throwaway wallets on a kdb, with the seeds in the comments. Is it safe?

>>1862 I'm 99% sure the comments are encrypted, yes.

>>1861 I see that you have not yet mastered the hidden art of search engines. (lol) https://www.amazon.com/Cryptex-USB-Flash-Drive-16/dp/B00RNBGJJK

This thread made me switch from keepass to keepassxc

>>2816 Same. It's nice to see some updates again.

i switched to xc a few months back and its nice, it does what it is supposed to, and if you fear of losing it in a decade, just Download the binary files and keep them somewhere, maybe in a few clouds too

plain text file encrypted with gpg works for me. one less thing to trust.

>>2832 can you edit encrypted Files or do you have to de and encrypt everytime You want to make a change? also do you have only one file with every Passwords or a folder with many files, one for each site/pass?

>>2835 You would decrypt it to read it or edit it. If you only read it you can just wipe the decrypted copy. If you edit it, you need to reencrypt it. It's all very easily done with shell scripts. If you like, put a launcher for the script on your task bar so you can just click an icon, enter a password, and have your passwords pop up in your editor. I use a single file. You could easily have the script encrypt and tarball a bunch of single files in a subdirectory, or even a bunch of subdirectories, but why make it more complicated than it needs to be? But that would look something like this: #!/bin/bash # # Create individual encrypted archives with .tg extension from all # subdirectories of current directory, using tar and gpg # # To Extract them all back into individual directories: # for foo in *.tg; do gpg -d $foo | tar xzvf - ; done # for foo in $(find . -type d -name "*" -not -path "."); do tar czvpf - $foo | gpg --symmetric --cipher-algo aes256 -o $foo.tg ; done

pass is a simple set of shell scripts that allows you to generate and store your password securely. It uses existing tools already installed on your computer, such as /dev/urandom and GnuPG, automatically makes it secure and convenient at the same time. Since the stored passwords are basically just some encrypted texts, one for each, makes your password database workable on any systems, even without pass. All the existing GnuPG customization you made also works out-of-box, e.g. OpenPGP Card for private key storage, an additional protection against master key thief. You can also use it to manage your secret text documents, never messing up your home directory with encrypted junks everywhere again. Though, it has its own problems. 1. Insecure clipboard. The password is copied to your clipboard. pass erases the clipboard after a few seconds, but it is not reliable. By default, some desktops log everything inside the clipboard for your convenience to paste, like KDE, make sure to turn it off. Also, unlike GnuPG, the memory of a clipboard is not protected at all, e.g. mlock(). 2. CLI All the Time. Every time you need to login to a website or enter a password, you need to open a terminal emulator, typing pass show -c example.com. You may want to get some desktop plugins. and yes, there are some autofill plugins available for your web browser too, which leds us to the next problem. 3. Cleartext Metadata, Account, etc. The database of pass is nothing but a bunch of encrypted texts, or we can call it a Key-Value NoSQL database if we use buzzwords. If you use it in an ordinary way, all the websites you use are already exposed in cleartext by file names. If you want to keep track of your accounts (especially if you have many pseudonyms), you may name them example@example.com, now exposing all your accounts. Autofill plugins require you to name the files in this way. Or if you want to make it a secret, you can create a multi-column text, but you cannot autofill or paste it anymore. You need to print them to stdout in cleartext on a terminal and copy and paste them individually, or call pass two times with --clip=line-number, one time for account, one time for pasword, and the name of your website is still stored in clear. 4. Paste Wrong Password Accidentally. If you do not want to expose your accounts and do not use a autofill, potentially you'll paste the password of your E-mail instead of your forum account (which is your E-mail address) accidentally sooner or later. If the forum is insecure but your mailbox is bulletproof, soykaf happens. Overall, I'm still using pass for my password management because it is simply and allows me to use my OpenPGP Card anyway. BTW, pass is created by Jason A. Donenfeld, he's a member of Gentoo Security Team, and the author of a new VPN, WireGuard[0]. It is a VPN implemented as a minimalist Linux kernel module and offers modern crypto, high security, flexibility and performance, you may want to check it out. [0] https://www.wireguard.io/

>>2840 >CLI All the Time Look up the `passmenu2` script, it's incredibly useful. I've slightly modified it because sometimes I have folders and passwords with the same name. I just launch it with my run prompt, which I have on command+R, which is nice.

>>1807 GPG is not a cipher

>>2840 For autofill, you do have to name your pass files after their domains, but you don't have to include the login in the filename (at least with browserpass). Just use the format "$PASSWORD\nlogin: $LOGIN". I think you can also do multiple accounts without naming the files after the actual login, since you can select the one you want when you activate autofill.

pass, it's simple and does it's job.

>>1861 >>2815 The problem is that you could just remove the four phillips screws to take the whole thing apart. Meaning if somebody has it, he can easily access the files on that drive.

Keepassx with database on NAS and local copies. Works great.

I keep copies of older keepass binaries backed up locally.

>>2840 I use pass as well, along with passmenu which is extremely convenient (bound with Mod+Ctrl+P on dwm). >cleartext domains and account names That's a compromise I'm willing to make, since it's only stored locally on my fully encrypted hard drive. Also, while having one GPG key for everything from encrypted mails to passwords is pretty convenient, it's also probably not ideal (over-centralized).

>>>>1218 I use kpcli (KeePass CLI), I don't know if it's good as the recent apps (like keepassxc), because kpcli still uses the keepass file v1, but I prefer a CLI app rather than a GUI one

I don't store any PWs, I just generate all the passwords on the fly based on the domain name. pw = Filter( domain, Hash( masterPW, domain + salt ).digestB64() ); Where 'domain' is the TLD & domain name (not subdomain). 'salt' is some random salt I change once in a while to change all my passwords at once. My PW generator keeps the old salt around. If I can't log in with the current one, I try the next older salt. The Filter function applies length and charset limitations of a given domain. The Hash() function is actually HMAC using SHA512. I avoid the clipboard issue because it in a browser plugin. The algorithms are simple enough I can rewrite them if I need to. I've lost "everything" once, and got all my passwords back by recreating the program from scratch. This means my salt isn't exactly "random", just a secondary password that I can store "insecurely" in a plugin, and it lets me keep the master PW the same even when I change all my PWs... My system gets stolen, they just have the salt, not the master password, and thus no other passwords are leaked. The salt also keeps folks from using rainbow tables to try and reverse my PW from the hash. > [current year] > storing passwords > trusting anyone else to write your password manager hello fbi-san, just ignore me as an outlier if you're reverse prorating the board's opsec capabilities by our answers.

My memory is really bad, so while I hate doing this, I just write my passwords in a small notebook. Then I put it into my fireproof/waterproof security box with my other valuables. I know it's flawed but the way I see it, the most I have to worry are nosy but not really malicious people.

>>5270 >digestB64 = limited character set but good that all possible outputs are obfuscated by being similar to each other, since if it was an encrypted file, when someone guesses the right password output would look sensible compared to the wrong password.

>>1226 pass is nice but i wish that it encrypted it's files with anonymous recipients by default. Right now anyone can get their hands on those files and know that they're your passwords, which i don't especially like.

>>5273 less flawed than storing it on your pc.

>>5519 True, all I know is that a computer is pretty fragile when compared to a rugged security box. The main flaw, as some family members have pointed out (my closest family mind you, I trust them) that a nosy girlfriend, buddy, or houseguest COULD swipe it since it's basically an oversized briefcase Next time I buy a security box, I'll get one that I can secure to the floor and have it much heavier.

>>5521 Your mistake is letting anyone know it exists in the first place. Hide a box in a drawer under some clothes or some soykaf and don't let anyone know it even exists. I have a pile of small keys for padlocks and such which I've dropped the key for the box in.

>/cyb/ >Using a password manager Just use an encrypted 4gb USB drive and pwgen.

>>5550 >pwgen 'no'

>>5550 4Gb is too much for passwds, you could do better using an encrypted 500Mb (less volume means more reliable) flash drive containing a keepass database using argon2 and a keyfile on a encrypted container on your HDD, essentially being 2fa. Some time ago I forgot a keepass master passwd and tryed to crack it using hashcat and failed, I could not get more than 1kH/s and I was'nt even using argon2, I did try for a week. Do not tru to recover your passwds, is loosing time. I still have'nt fully recovered.

My brain.

>>1232 >>5270 How secure are these kinds of solutions, really? I am looking for changing my password management scheme (currently I'm using a GPG-encrypted file) and this sounds pretty neat. What are the caveats? Provided my master password is strong, how much am I compromising by undirectly basing my other passwords on it?

password manager is a single point of failure, I remember every password I use

A text file on my desktop keeps all my passwords. I use full disk encryption so this should be fairly secure.

>>7003 so if someone gets a hold of your computer while it's on, you're fuarrrked?

>>7004 I don't leave my computer unattended without fully turning it off but if glow-in-the-darks got to me I'd be fuarrrked either way. >In cryptography, rubber-hose cryptanalysis is a euphemism for the extraction of cryptographic secrets (e.g. the password to an encrypted file) from a person by coercion or torture—such as beating that person with a rubber hose, hence the name—in contrast to a mathematical or technical cryptanalytic attack.

>>7012 if you're ever tortured, you can just rest easy that you have nothing to gain and everything to lose by giving up your info. If they're torturing you it's because they need your info, and if they really don't need your info they're just sadists who will torture you anyway. They'll try to make it seem pointless to keep your secret but that's the oldest trick in the book.

>>7017 They could always use that magic drug needle that makes you talk but that option is *probably* reserved for people who hold state secrets.

Haven't used any password manager so far, but would like to. Has anyone used mooltipass or some other hardware password manager?

>>7021 not really a thing.

>>7017 I don't understand >you have nothing to gain what about the end of tortures?

>>7025 and be thrown in prison for life or killed?

>>1218 Forgive me if I'm wrong, but a series of words is easier to personally remember without a manager while taking longer to guess for crackers, isn't it? So I use the 14 words and a set of numbers myself, depending on site.

>>7029 I am sure that your password is think blue count one tow

>>7023 altered and decayed thinking capabilities could very easily lead to someone giving up info without a fight, assuming they could still speak barbiturates, benzodiazepines, deliriants. the list goes on. especially deliriants, since they might tend to make you forget why you had to keep the secret in the first place. i assure you, it's a very real strategy.

>>6996 Your meatware is a single point of failure. Memory is most certainly fallible. I had a scare once where I legitimately couldn't remember a passphrase for an SSH key I had made. Thankfully I ended up remembering it a few months later, but I'd definitely recommend not putting all your eggs in your grey matter basket.

>>7023 >>7159 Or scopolomine....