71–80 of 199 posts
1. My browser vendor can access my browser passwords anyway.
2. It's better to trust fewer vendors and pieces of software.
3. Copying passwords to clipboard is awfully insecure.
4. Trying to remember all passwords is also awfully insecure.
I do not save any money-related passwords. I do dream of switching to pass from time to time.
You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…
3. Can actually be mitigated, or other options can be used. For example, in my browser I disabled JavaScript clipboard access, so that random websites can't access my passwords. You mention pass, aan excellent non cloud option, which I personally use with a script that types in the password as if it was a keyboard - but Firefox and chrome plugins with autofill are available, and those are offline.
Sometime ago, I bought 1Password for iOS, then Mac, mostly for convenience and I was happy with it until I got no viable way to use it on Windows simply because their client still in early development sucked. After some time again they stopped caring about the local db feature and for me that was it. I Moved immediately to Keepass and never looked back. The reason was because I can find a client for nearly every plat…
I also find it extremely important for my password manager to be available on EVERY platform I might use. Not just the popular ones a company can make a business case to support. Historically this has been a bigger issue than at present, but its still a big one to me.
You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…
1. Is not necessarily true. If you use an open source browser like firefox, your browser vendor would absolutely not be able to access your passwords (...without creating a huge scandal where users would catch up immediately) 3. Can actually be mitigated, or other options can be used. For example, in my browser I disabled JavaScript clipboard access, so that random websites can't access my passwords. You mention pass…
My current setup:
On non-critical services(social media etc.) or websites with U2F, I reuse passwords.
For everything else, I use Purse[0] with Yubikey.
I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…
I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?
Earlier quoted context omitted.
I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?
pass can encrypt to multiple keys. I use one key for my laptop and one for my phone. If someone gets your gpg key then they can decrypt all your passwords if they also get the repository. It would be prudent to change all your passwords in this case (pass-rotate could help a little with this). If you lose the key, you lose access to all your passwords.
I gave up on cloud-based password managers. My current setup: On non-critical services(social media etc.) or websites with U2F, I reuse passwords. For everything else, I use Purse[0] with Yubikey. [0] https://github.com/drduh/Purse
Earlier quoted context omitted.
I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?
I think GPG keys get a lot of flack for not being the most user friendly thing and probably fair enough. The nature of them having to remain secret, makes managing them a bit confusing. I don't use mine for anything more than signing commits and (rarely) encrypting secrets Personally, I use OpenKeychain[1] on Android, Kleopatra[2] on Linux, GPG Suite[3] on macOS and Pass[4] for iOS/iPadOS Phew, that's a lotta apps bu…
FWIW, the pull to refresh effectively just runs `git pull`. GPG isn't involved.