Passwords

Hi lainons. Do you using passwords manager or something like this? I have a problem using the same password for most of my accounts and it is rather not safe.

I think most people don't need them; Just use a small pocket notebook to write your passwords down. For most people it's the best (and also cheapest) solution. If you want to add some sort of security layer, just write hints and not the actual password. 1Password is turning into a soykafshow. I bet others will fellow. I've never and will never use such services. Use your brain or a notebook. Or both.

https://www.passwordstore.org/ pass, the standard Unix password manager Easy to use, version-controlled, future-proof (as long as plain text and GPG/PGP continue to exist). Pass is an interface for using git and GPG to manage a collection of files containing sensitive data. You can run your own password server if you require access on multiple devices. There are over a dozen well-maintained plugins/supplementary scripts which do useful things, like providing OTP support, and adding Tomb support. There are multiple well-made third-party mobile apps which support pass, and the author of pass encourages their development. Pass is also free software. This is the best password manager I’ve ever used. The one drawback is that the directory structure is not encrypted, so it’s possible to view the names of the encrypted files containing passwords, which in practice will have the name of the service - e.g. you’ll have a file called ~/.passwordstore/Streaming/Netflix.gpg, which when unencrypted presumably contains your username and password for Netflix in plain text. Whether this is suitable for your use case is up to you - I’ve found the flexibility and simplicity of pass to be more than enough of a trade-off for this unfortunate inconvenience. pass-tomb will encrypt your password store, but it’s not compatible with the third-party iOS app I use for pass (passforios). It is also built for use with a Unix terminal, and for my part I’ve never found a GUI frontend that I like. It’s nicer I’ve found though to have access to all my favourite text editors and keyboard shortcuts in a terminal anyway, so this really isn’t a big deal for me personally - make of it what you will. For this reason too I have no idea how well it plays on Windows - you may well want WSL if you use it on windows. Finally, while some of the third-party mobile apps seem to support some kind of browser integration, I’ve never gotten it to work nor have I tried very hard - you might want to explore this if browser integration is a big deal for you.

>>9287 this. I've used pass for a while and don't think I'll ever use anything else. On desktop the browser integration with Firefox works great. Integrating it with other software is trivial as long as that software has some kind of plugin functionality that can run shell scripts. Much easier than dealing with a custom API like youd have with other password managers. Syncing is done with git. I just keep a seperate fork for each device I own and manually merge them occasionally although since it's literally just a git repo I'm sure I could set up a build hook that does the pushing to origin automatically. I could see an arguement for keepass in certain applications (like on windows or if the metadata exposure you mentioned is an issue) but besides those two I don't know why anyone would use any other password manager.

>>9285 In the past I used diceware to generate my passphrases and keepassx to store them. But now I >>9286, and burn the paper afterwards.

>>9288 this as well. i started using a password manager with pass, and never looked at anything else. It's how a password manager should work, because it makes it so trivial to integrate to anything.

If you just want to avoid having your universal password leaked any pw manager will do just fine. A hosted pw manager is convinient and an offline is more secure. Your pick. And maybe check if your pw is out there while you are at it: https://haveibeenpwned.com/ If you happen to use linux, give keepmenu a try.

>>9291 Hosted password managers are probably fine for security. The problem with them is you're essentially giving some company a list of websites and services you have accounts on so its bad for privacy.

>>9292 Is that ``List of websites'' not encrypted tho, Like most offline pw manager software would do? It all depends on your thread level security wise. There are easy ways to get a client's master pw. Although services will most likely not exploit these. Self hosting can help with this, but then you start going into hobbyist (or paranoid) levels of security.

>>9293 It could be entirely encrypted as well and only decrypted client-side, but that depends on how they implement it. If it's proprietary, they probably want to keep lists of the sites you visit for marketable user metrics.

https://www.crowdsupply.com/third-pin/pastilda A keyboard emulator is the best choice. Naturally crossplatform, idiotproof, offline.

Keepass Put the database on a flash drive or sync it to a private server like nextcloud. Use a strong master password and write it down. You'll eventually memorize it, or alternatively save a keyfile portably. At least that's how I've been doing it for the past decade.

>>9359 This. Keepass/X supports HMAC, which can add a physical layer that's difficult to capture. If you're using a private server, follow best practices. Enable end to end encryption, even though the database is already encrypted, otherwise you might as well put it on Google. Ideally everyone would keep their databases in hardware keys. Burnable paper is good too.

>>9287 Pass is a perfect example of how you don't need bullshit software "services".

>>9287 I've used it with WSL on Windows, it works just as you would expect, you need an X server such as VcXsrv or Xming for clipboard functionality to work. The setup would be as secure as Windows in that case, whatever you think that is.

>>9285 No, I write them in a txt file and encrypt it with PGP.

>>9285 GNU Pass

Lots of lainons in this thread recommend an asymmetric database (pass) over a symmetric one. What's the benefit if the private keys are on the same device as the database? Clearly there's an advantage if you have a hardware token, but if you don't?

>>9383 From my understanding there isn't from a cryptographic standpoint, but there isn't really a disadvantage either. The advantage is being able to leverage GnuPG. GPG agent + PAM is a powerful combination that gives you all of the functionality of gnome's password manager, macos keychain, etc. but with a simple interface that lets you build encryption into your shell scripts really easily. I use this for e.g. storing my email password for msmtp.

I wonder how feasible it would be to name password files in a gnu pass store by the hash of their name instead of their name itself. At least for storage and retrieval it seems like it would be a trivial to implement. You wouldnt immediately be able to list the password database but this could be resolved by including an encrypted metadata file associated with each password file (which would also have the benefit of enabling annotations like comments.. which is one of the only features from keepass that I miss with pass). This would be slower if you need to search through a large password store but that doesn't come up very often in my use case. Since I have a consistent naming convention I usually know exactly which file I need to decrypt without needing to search for it. The other disadvantage over keepass is you could hash a bunch of common websites and compare, and if you know a few of the targets emails you could hash those to figure out which address their accounts are under, but at least you wouldnt be giving away everything but the password like how it works now.

>>9385 Thanks anon

>>9285 In my humble opinion, for every normal person Bitwarden might be one of the best choices. It's cheap (free even if you want) or can be self hosted. What I prefer though is KeePass or just simply pass. KeePass allows you to have your database offline. The only downside it has is that you have to manually sync your database instead of having a server to sync it with. >>9370 >I've used it with WSL on Windows I've not thought about that at all. I've been using pass for about a year when I had to switch back to KeePass because either the Windows client wouldn't work or the software for Windows was outdated. I might give this another shot, thanks! >>9386 I really like your idea, lainon! Maybe someone will implement something like this one day. It would completely eliminate the issue of having the sites exposed which you have accounts for. Therefore it would be even more feasible to use than a "traditional" password manager (e.g. KeePass).

Linux - KeepassXC Android - Keepass2Android + ykDroid Syncing - Syncthing Use a password + HMAC challenge-response with a yubikey and sync the database to your other devices. Then you've got effectively backups and access on multiple devices. There's a plugin for Firefox (KeepassXC-Browser) and with Keepass2Android you can fill in credentials quite easily with it. At the same time you can set up TOTP for accounts and use them on Linux and Android just fine. Make sure you drives are encrypted with a sufficiently strong password.

Also worth noting, Syncthing only syncs while on your network, so it doesn't use external services, just LAN based syncing between devices.

>>9474 >>9473 I love Syncthing, it finally got me to ditch cloud services. What do you guys think about Cryptee?

>>9586 >We are based in Estonia, Europe Former Nazi Germany collaborator and Soviet Union Republic. Named "the most advanced digital society in the world" by Wired, and a country where the government runs on blockchain. I almost choked on my gluten-free smoothie. Here are few points: It's not free software. It's centralized, you can not host the server. It's not a filesystem extension, but a "do everything in Google Chrome stylized as client application" thing with lots of security holes. "Deniable" encryption does not exist, it's all hide-and seek games with steganography. They cover their technical ineptness with bureaucracy. Creating paper-like documents and putting file folders into directory lockers is soo 1940's, it's just plain inefficient, learn 2 hypermedia and write a personal wiki.

Since there are no self-hosted server sources, once their interest switches to something else and they stop supporting it, their software turns into pumpkin without possibility of someone else forking it and continuing development.

>>9592 At least our digital ID software is free as in freedom and we can get a government email address... ...so dont judge >: - (

>>9592 >it's just plain inefficient, learn 2 hypermedia and write a personal wiki. So far I just write in plaintext and sync it with the desktop via syncthing.

>>9598 An EstLain! How lovely! But on a more serious note, i encrypt most of my files that i send over the network with our ID card. I can specify exacly who the other citizen is who can decrypt it.

>>9611 Eestlane igas sadamas.

>>9611 Estlainons represent! Maybe, because its cold and boring often, we get overly attached to our computers. Neat. So it's basically a government issued GPG key, no? Never thought of it that way. >>9612 IIRC Hemingway wrote that around the same time two Estonian bros decided to sail over the Atlantic and to the US. It was all over the news there. He might've met them or something. Mulle tundub nagu eestlased kipuvad olema uhkemad, kui leiavad teineteisi internetis, võrreldes teiste rahvustega. Või siis see lihtsalt tundub mulle nii, sest ma ei pane seda võõramaalaste juures tähele. Regarding the actual topic, I try to use KeePassX, but I end up often just writing them in unencrypted text files, cuz I'm lazy and dumb. Most of them are throwaway shadow accounts anyway.

>>9611 >using government-backdoored hardware to encrypt files

>>9619 Not all of us live in a place where trust in your government is absolutely unthinkable.

>>9612 Annan ka enda kohalolekust teada, tore teada, et isegi siin on eestlasi :)

>>9286 I really like 1password, it does quite a lot for you, generates passowrds and checks for password leaks on the internet for example. Also the UI is nice, so I managed to get my family to use it.

>>9627 Government is not your friend, it's a representative of your interests, it should be verifiable, responsible and re-electable, if needed - with force. Never trust a government no matter how many sweet things a man in the suit says to you, they are all half-truths at best and he's pursuing his own interest rarely intersecting with your own. If the hardware is proprietary, if algorithm and software are kept secret, then you shouldn't even trust a friend who offers you such thing, it's practically insecure. Why do you still have this bureaucratic soviet mindset, it's poisoning your liberties, who the hell thought delegating voting privacy and count to a computer was an ok thing? Let me guess, it was one of those ex-CPSU "reformed" members, the "technocrat progressive" kind. Or does this collectivism has something to do with asiatic admixture of your people, same as in Finland?

>>9630 >>9286 What's wrong with open source software like KeePass?

>>9285 The truth is, any solution that exists currently is inadequate. Remembering passwords is straight out of the question, there is no human that can come up with unique passwords with enough entropy for different websites. Securely generating random passphrases and either storing it on KeepassXC (>>9637) or writing it down (>>9286) isn't terrible, but not many people will actually do it. This is what I'd recommend for most websites. Just remember to keep secure backups so you don't get locked out of all your accounts (do this before the computer with your password manager file gets stolen by the TSA). The most important thing by far is using U2F/2FA on *every single website that supports it*. Preferably with a yubikey and a backup, but your phone's authenticator is fine if you really must. I'm surprised I haven't seen it mentioned in this thread, but the W3C has published a standard called WebAuthn that's like the next level of U2F: username-less and password-less logins to websites. Authentication is done by signing a statement using your private key, which for most people will be on their phone, but you could use a Yubikey for extra security. No more passwords. There's a explanation for normal people over at http://webauthn.guide/. If you run a website, consider accepting WebAuthn logins.

>>9638 There are different two-factor authentication technologies. The simplest one of them is SMS code, and also widely adopted, but obviously inconvenient for privacy-conscious persons. Smart Card or USB key authentications require JavaScript to be running in browser unless it's a standalone application, and the firmware/hardware freedom is a great issue with them.

>>9640 Good points lainon. No one (privacy conscious or not) should ever consider SMS based 2FA, just because of the huge security risk of phone porting (carriers are incredibly dumb--Coinbase and other security teams have been targeted using phone porting attacks in the past). Your point about the JavaScript is good too. There's actually an active discussion on the Webauthn tracker right now about a JavaScript-less implementation (https://github.com/w3c/webauthn/issues/1255). To be honest, I don't have much hope it'll be implemented within the next year or two, but once the spec is more solidified, I would not be surprised if Mozilla starts to push for this. As for the firmware/hardware freedom (and also security) issues: fair point as well. There's always the Solokey (https://solokeys.com/) which has FIDO2 (aka webauthn) support, but I don't own one or know much about it. Anyone else have experience with a Solokey?

>>9627 there is no other place.

>>9627 https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Clipper_chip You shouldn't trust any government with protecting your personal communications.

I use keepassxc. It's pretty great I think. I store all kinds of stuff in my database since you can save files in it, not just passwords. ssh keys and things like that. I think it's a bad idea to use those online password managers. That just seems like a recipie for disaster.

I know that's somewhat off topic, but I'd love for one of the estlainon to explain how that gov email and encryption thing works. Lately I've been thinking about ways to unfuck emails/enforce using encryption/enforce some form of authentication for gov stuff, healthcare and so on, but it always comes back to having to trust whoever issues the keys with everything, including not being completely incompetent. I get shivers just thinking about the nightmare it would be to prove your identity in order to revoke a key and generate a new one in a society where that very key is considered the only authorivative id system -- which would happen about a decade in, once most service drop other means of identification. Anyway, I've been using keepass for years but now I'm slowly getting used to pass/tomb.

https://bitwarden.com/ is open source. convenient. cross-platform. just works. free. If you want to support them you can pay $1 a month and also get access to using it for 2FA.

>>9752 second this. my first thought was i probably wouldn't use that to encrypt anything too important but knowing that everyone in the country has a encryption key available to them would certainly be preferable to the choice between proprietary chat apps or twisting their arm to set up pgp like i currently have to deal with.

I just solved all your password problems, cross-referencing with discussion in >>9560 Create a GPG key pair. The signup form asks for your public key. Every time you need to log in the server sends you a random string. You have to sign it with your private key to prove identity aka authenticate yourself to the server. Genius, eh? Don't tell me I just described what those 'Ubergay' tokens do

>>9758 look up sqrl

I use 1Password. It is good. Yes, there are more esoteric solutions that are more secure, but security is always about risk assessment and balance with convenience. I use Privacy to create vendor locked credit cards. I use my Yubikeys for 2FA, TOTP based, via Yubikey Authenticator, and U2F for services that support it. I use Google Voice exclusively, so SMS based 2FA is protected by hardware 2FA. I use a password stored on a dedicated Yubikey to login to 1Password. Life is good. Traveling is easy and I don't have to work about losing anything as my keys are duplicated. The best thing to consider, whatever method you use, is to have a playbook. If you lose your 2FA devices, lose your phone, or you think an account was compromised, what will you do? The second best thing. Get your own domain and pay for email hosting. Having 24/7 support for an account linked to your identity is key. Now, if you have heightened privacy concerns, other suggestions here are better. But security and privacy aren't the same concerns.

>>9777 >1Password >"""Privacy""" card >Yubikey If we played bingo in this thread, you'd score proprietary garbage corporate slave one.

KeepassXC works well enough I sync it with my nextcloud