151–160 of 199 posts
Earlier quoted context omitted.
>I do not save any money-related passwords. I do dream of switching to pass from time to time. So you remember unique, high entropy passwords for all your money related sites? If not, you might be putting yourself at greater risk than syncing the passwords.
Obligatory https://xkcd.com/936/
1. I don't trust my mobile device
2. I don't like the odds of it being stolen or lost
3. I don't need the constant distractions anyway
I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…
Sadly this isn’t a modern solution. People have smartphones and occasionally have to login to Windows (without WSL). While I’d love for everything I use to provide an easily accessible *nix shell it just isn’t practical for phone use or modern computing environment where you can access cloud data using web services from any internet connected computers/devices.
Since I absolutely need a cross platform password manager, especially on mobile, I felt this to be the most logical solution.
I gave up on cloud-based password managers. My current setup: On non-critical services(social media etc.) or websites with U2F, I reuse passwords. For everything else, I use Purse[0] with Yubikey. [0] https://github.com/drduh/Purse
but in case you have 3 computers, how to sync passwords?
Also, the 1password support guy was super super super nice to me. Well, the Bitwarden support guy/gal (i don't remember that one) was nice too.
Speaking of trust, I mean that's quite complicated, right? No matter what justification I give, there is some risk and a lot of technicalities which I am not aware of.
Earlier quoted context omitted.
>maths. It’s proven. No they are not. That’s one of the things that makes designing correct crypto systems difficult. Going the wrong way through most cryptographic trap doors is conjectured to be difficult but I’m unaware of a single one that’s proven.
The one-time pad has been proven to have perfect secrecy. Given a ciphertext, the only information available is its length.
You have a way to securely exchange or store the one time pad (at that point just use slices of the pad as passwords)
The pad is sufficiently random
This was how RC4 was used to encrypt things; RC4 is fundamentally a random number generator. To use it you throw away the first so many bytes (because they could be used to recover the state of the machine.) and then the rest was used as a pad. Unfortunetly patterns in the data can make it easy to recover the raw RC4 pad (uncompressed blank bitmaps for example) and this can be used (again) to recover the state of the machine generating the numbers. On top of that it turns out RC4 is a lot more predictable than people originally thought.
Essentially all a one time pad does is move the problem somewhere else, often that other place isn't great.
I just use KeePass, and Syncthing to automatically sync its encrypted password file (and other files I care about) to my android phone and all my windows computers. No cloud needed.
Passwords are those little peckers, that make everyday's life with a computer uncomfortable. So it would make a lot of sense to sync them between all the machines I use. But it's never going to happen, that I store my passwords on your computer!
You must rip them out of my dead, cold hands!
Locally, I use KeePass and KeePassX on Windows, Android and Linux and Keychain on macOS.
1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to elimin…
I read up on their blogs and as much technical explanation as I could find, and by far 1Password seems to be the best with a cloud offering. Also Apple buying into using 1Password company wide helps gain some trust (I am sure there was some serious auditing): https://medium.com/enrique-dans/apple-and-1passwords-deal-sh...
Huh! One would assume, they use Keychain with iCloud?