Password Management

How do you manage your passwords? My new year's resolution was to go through my passwords and update them for security purposes. I realized I'm being a complete idiot by basically centralizing everything in an online password manager. I don't have a lot of general security concerns but I've got a couple hundred accounts in there, way too many to manually update every password--I need some sort of bigger-picture solution. Do you keep your passwords offline? Do you actually use password managers? What do you do?

KeePass server behind a homemade VPN at my parents house

I don't have many accounts, also my passwords are pretty short and similar to each other. Probably one of the best ways is using KeePass inside QubesOS' vault, which I intend to do once I switch to it.

>>20708 I use password-store: https://www.passwordstore.org/

>>20708 i used to use keepassxc but i deleted some unused accounts and realized that i have so few passwords that i don't need a password manager.

>>20708 I keep all my passwords on a floppy disk in a .txt file. TRY AND HACK MY FLOPPY, LAW MAN!

>>20709 >>20710 >>20711 >>20712 These are helpful answers that I can definitely use to figure out some kind of password-management solution.... ...but in general, I'm thinking about how to handle the number of accounts requiring passwords and, I guess, a reasonable way to distribute a variety of passwords, or if there's some other solution. I.e. for general use and absent any really seriously-identified threat, is it sufficient to just rotate a handful (2-3) well-formed passwords through one of the solutions mentioned here? Should I really be trying to limit the number of services I'm using in general? I feel like the centralization of a password manager essentially replacing my memory is part of the issue here--and that keeping passwords simple enough to actually be remembered is actually even less secure. How do you manage that particular difficultly?

I have various ways I store them. Sometimes they are just passages from literature I have memorized. Others are just random strings of ASCII I have memorized. Some I have encrypted in ciphertext and hidden away, and some I have saved in keepassxc. There is not one way correct way of storing your passwords, everyone has different threat models which will demand a different structuring of security, but you're best off keeping them in your mind or in an encrypted database on your device. >>20722 Passwords do not need to be simple to be memorized, I have memorized a couple 120-130 character strings of random ASCII.

keepassxc keepassxc keepassxc keepassxc

>>20722 It doesn't really matter if your password is simple, you're more likely to get hacked by someone running combos of your leaked credentials until they get in, if they don't they aren't going to brute force you, just move down the list to the next account. The best way to protect passwords against hackers is to keep them on a physical sheet of paper.

I wrote my own password manager and run it on an airgapped machine

>>20708 I write them down in a notebook, recopy the accounts that I still use at the end of the year into a new notebook then burn the previous one.

Free idea. Kb with memory card slot, lcd display, password lookup and auto fill feature.

I use KepassXC and KeeassDX on android. I sync the database with syncthing.

Bitwarden but Im setting up vaultwarden soon. I've got my bitwarden account tied to an email only used for that account.

I use Pass, the standard UNIX password manager. I unlock my password database with my GPG key.

I use Dashlane. I prefer it over KeepPass and Password1. It's a little easier to share a password or secure note with Dashlane as well.

>>20708 I use KeePassXC and KeePassDX with mega.nz sync. Mega glows but its free, easy, and kdbx is encrypted anyway.

>>20916 I just bought a smartphone (finally after all these years) and was wondering if I could use Kepass on it. How's KeepassDX compared to Keepass2Android ? As my smartphone OS is /e/ I have a secured cloud space on Murena to host my database. I useKeepassXC on my machines tho.

>>20917 I've honestly never used KeePass2Android, but KeePassDX is really nice, don't feel the need to switch.

>>20713 By the time the police find it, it'll already have stage 5 diskrot! Ha, take dat coppers!

as other anons have pointed out, keepassxc is your best bet. completely encrypted, can be completely offline, will generate good passwords for you, and generally just werkz.

>>20722 > is it sufficient to just rotate a handful (2-3) well-formed passwords through one of the solutions mentioned here? Generally recommended best practice is to use unique passwords. If some service you use get hacked and they are retarded with regards to the password storage (i. e. they save passwords unhashed), then your password will be public and your other accounts could be potentially compromised. >>20737 >I wrote my own password manager and run it on an airgapped machine How do you get passwords from the airgapped machine to the machine where you actually want to use said passwords? Do you just diplay the passwords and type it out on the other machine?

pass, the standard unix password manager. only thing I don't like is it using public-key crypto instead of something like aes or serpent.

I use the most secure system of all, my own brain.

unironically just use firefox password saver and VPN. I then pray for the best!

>>22887 a password manager can't be waterboarded. until quantum computing becomes mainstream, encryption is way better than how tough you think you are.

>>22889 Password managers can and do get hacked.

>>22890 But they won't yield to a baseball bat wrapped in barbed wire.

>>22891 As if you can't just do the exact same thing to try to get the master password for a password manager. Who are you trying to impress?

>>22889 Assuming a scenario where rubber hose is a bigger threat than hacks, and also for some weird reason the torturer won't have access to your hardware, maybe it could be better. In practice, all the people who decided to store their cryptocurrency keys in password managers have been getting consistently fuarrrked, and reported incidents of torturing for the same are relatively low. As for actual passwords who even gives a soykaf about them anymore? Everything important requires 2fA now and makes you confirm email or 2fa from any new device or IP.

>>22889 >until quantum computing becomes mainstream, encryption is way better than how tough you think you are. Quantum computing won't have an effect here. Any decent password manager uses symmetric key encryption with 256 bit key sizes as the master password. Grovers algorithm reduces the search space for bruteforce attacks from 2^256 to 2^128 but that's still so large that nobody is ever cracking it.

>>22893 A lot of password managers support one time password generation and if they support SMS or telephone callback then they can be uh delt with. Naturally you want 2fa sometimes but fuarrrk these motherfuckers making you use it for your 711 rewards and other stupid soykaf.

>>20708 I have 3 personal and 3 professional passwords that I can change in 3 different ways. All of them look completely random and can only be crack by brute force. With 7 character for the shortest to 15 to the max security password, I am safe. This is how it is done: you choose a long or two short words. Take butterfly. This word will be for instance your first personal password. Make the standard leet changes. 8u773rfly. Add some majs for the lulz. 8u773rFLY Now mix it. Let say you choose 2 as your key for the mix. 8u77 3rFLY become 8u37r7FLY. That's perso2. Not bad as it is, but now, most people use a qwerty keyboard so hackers try to hack passwords wrote with the letter it can make. I like to add a few ï or ç. 8u37r7FLYïçà is perso2++. I will keep the last way I have to change my password for myself. Feel free to create your own and to write a .txt that list which password you use and where. You can save 4chan gold account ID: Not_Glowie PW: perso1+ uncrypted on your PC, no one can use that information if you keep your secrets. But just crypt it anyway.

7 characters is weak even if it's truly random. 15 random characters is the bare minimum in modern days. It's not 1995 anymore. >1337 word shuffled around, append complex characters at the end It's not a unique idea and is something that every hash cracking tool has ready-made rulesets to target.

keepassxc stores password generator options in the plaintext keepassxc.ini. disable writes or symlink it to /dev/null to stop this information leak.

>>22895 tfw they go at you with a wrench but you'll never give up your 711 rewards

>>22897 I know. Still, 'é' is a password that will survive 75% of the scripts. It's always a good idea to place one somewhere. You have to balance how hard it will be to hack and how easy it is to remember. The idea of having an extendable end is to add characters to your password. Yes a completely random 12 characters password will be a lot stronger than 8u37r7FLYïçà, but you will have to store it somewhere and that place can be hacked. I don't think this password can be guessed, leet or not, so that leave only brute force. That's the point of using words and modifying them. You don't need to log to your password manager to use your passwords. Anyway, if your home is safe, I recommend pen and paper to save your passwords. Good luck hacking that.

Related question: what is the best combination of special characters, e.g. !@#$%, for hand-written password generator?

>>22912 "!" and " " are the most commonly used but if you're generating passwords, you should just allow all of the characters and generate as long a password as the site allows. use a csprng and make sure your seed isn't predictable.

>>22912 The best one is a long one that you can remember. With my azerty, it take one second to type *$=)^ù!:;, The maj key is your friend.

>>20712 >>20731 and it generates TOTP also. Never reuse passwords, that's the objective of the manager, totally random passwords between accounts.

I use password123 for everything and I've never had to deal with forgetting a password this way. I actually use bitwarden, and for more important accounts use salt and pepper on top of a generated password.

>>22914 >use a csprng Is hmac-sha256 csprng?

>>23247 hmac-sha256 on its own is not a csprng, however you can use it as the hmac for hmac-drbg which is a csprng.

>>20708 OP here, forgot about this thread but it's almost exactly a year later! Would you look at that! I ended up setting up a KeePassXC db on a fileserver on my home network. Not absolutely airtight but so long as nobody mucks around in the network it seems reasonably secure. The biggest challenge I'm actually facing is just accessing passwords while I'm away from the network! Helped me to realize that phones actually just stay logged in 95% of the time--for all the rest, I've basically just decided to either write down/memorize the handful of passwords I genuinely need when away from home. I could theoretically set up a VPS or make the server remotely accessible, but it just seems like such a stupid idea to A) open up the home network and B) leave the db vulnerable. If there's anything I've taken away from the past year of trying to figure this out: every solution is a compromise between convenience and security! You need to make the choices that matter to your specific use case. Because my needs are relatively simple, I can get away with not trying too hard. Hope all goes well in the coming year for those considering their own security practices.

>>23261 You can download a copy of the database to your phone and use a keepass app (foss ones are on fdroid) to access that local copy when networking isn't available.

>>23273 Good idea, but is there an easy way to keep it synced/up to date? And to sync any updates I make on the phone copy to the main db on the home network fileserver? If I need to be manually copying it back and forth it would be just about as much effort as just writing stuff down. I guess it's up to your profile/use-case but seems to me that just carrying around all your passwords on your phone (even in encrypted form) is best avoided as an incredibly messy attack surface.

>>23290 >is there an easy way to keep it synced/up to date? Syncthing, although just take extra care with KeePass database. Just make sure to not have them opened during a sync and do syncing explicitly (as in only temporarily and not always having syncthing opened).

>>23290 As long as both copies use the same master password, you can easily merge them. You can keep it in sync with a remote copy using the save/load to/from remote url feature: https://keepass.info/help/v2/ioconnect.html I think you're getting ahead of yourself, though. In practice, syncing copies isn't a big deal. I don't create new passwords often enough that diverging databases becomes an issue. Even then, merging the database manually doesn't involve copying the individual entries manually. It's just a matter of clicking a merge button in keepass.