Ask HN: where to keep passwords

#1

Post by awongh » Thu, Apr 22, 2010, 10:42 PM UTC

Right now my system for keeping passwords is terrible and unorganized. I'd like to know what the best and most secure and also accessible way is.

I'm talking about personal passwords too, but mostly I'm thinking about work passwords. Your client's hosting or domain registrar password, the system db admin password, your basecamp password, etc. etc., etc., -you can't remember them all, what do you do so that they're secure, but you can access a system when you're not in front of your main machine? Or instead of a super-mega secure bunch of passwords (that you change regularly, like they say you should), is it better to have a single (or a couple) secure one(s) you can remember, then not have to keep anywhere?

Re: Ask HN: where to keep passwords

#2

Post by sunchild » Thu, Apr 22, 2010, 11:11 PM UTC

1Password. http://agilewebsolutions.com/products/1Password

Re: Ask HN: where to keep passwords

#3

Post by Serene » Thu, Apr 22, 2010, 11:16 PM UTC

Better to memorize 3-4 master passwords. I heard about KeePass password management utility but never used it.

A new authentication device will be available later this year - based on Hitachi's Finger Vein imaging (VeinID) and fingerprint identification technology.

Re: Ask HN: where to keep passwords

#4

Post by yradunchev » Thu, Apr 22, 2010, 11:32 PM UTC

$ nano passwords

ctrl+x y

$ gpg -c passwords

and you have all your passwords in a password protected and encrypted file. To decrypt:

$ gpg passwords.gpg

Re: Ask HN: where to keep passwords

#5

Post by awongh » Fri, Apr 23, 2010, 12:23 AM UTC

yradunchev wrote: post #4

$ nano passwords ctrl+x y $ gpg -c passwords and you have all your passwords in a password protected and encrypted file. To decrypt: $ gpg passwords.gpg

sounds ok, does the -c mean that I don't need to make any keys, like if I look at the file on another computer?

Re: Ask HN: where to keep passwords

#6

Post by briandoll » Fri, Apr 23, 2010, 6:21 AM UTC

sunchild wrote: post #2

1Password. http://agilewebsolutions.com/products/1Password

+1 for 1Password. It also can generate difficult passwords for you, so you're not even aware of what they are. Add private sharing via Dropbox and your secure passwords are with you on every machine.

Re: Ask HN: where to keep passwords

#7

Post by yradunchev » Fri, Apr 23, 2010, 6:25 AM UTC

awongh wrote: post #5

yradunchev wrote: post #4

$ nano passwords ctrl+x y $ gpg -c passwords and you have all your passwords in a password protected and encrypted file. To decrypt: $ gpg passwords.gpg

sounds ok, does the -c mean that I don't need to make any keys, like if I look at the file on another computer?

yes - it's just password protected and encrypted with the passphrase you use when gpg asks you. all you need to open the file on another computer is gpg and, of course, the passphrase used.

even better - when you need certain password you can do:

$ gpg -d passwords.gpg | grep yradunchev@mail.me

and you will get the password for that mail account only and the entire encrypted file will stay encrypted and never will be saved as plain text file on the system you use at the moment.

Re: Ask HN: where to keep passwords

#8

Post by sunchild » Fri, Apr 23, 2010, 12:47 PM UTC

briandoll wrote: post #6

sunchild wrote: post #2

1Password. http://agilewebsolutions.com/products/1Password

+1 for 1Password. It also can generate difficult passwords for you, so you're not even aware of what they are. Add private sharing via Dropbox and your secure passwords are with you on every machine.

"private sharing via Dropbox"

Wouldn't that expose your passwords to a prying DropBox admin? I don't use DB, so I'm not sure whether you generate your own key to encrypt data at rest.

Re: Ask HN: where to keep passwords

#9

Post by briandoll » Fri, Apr 23, 2010, 2:22 PM UTC

sunchild wrote: post #8

briandoll wrote: post #6

Earlier quoted context omitted.

+1 for 1Password. It also can generate difficult passwords for you, so you're not even aware of what they are. Add private sharing via Dropbox and your secure passwords are with you on every machine.

"private sharing via Dropbox" Wouldn't that expose your passwords to a prying DropBox admin? I don't use DB, so I'm not sure whether you generate your own key to encrypt data at rest.

Your password archive is encrypted at rest with a passphrase that you set. Even if you got my password archive and you had 1Password you'd still need to crack the master passphrase before it would be useful.

Re: Ask HN: where to keep passwords

#10

Post by awongh » Fri, Apr 23, 2010, 11:45 PM UTC

sunchild wrote: post #2

1Password. http://agilewebsolutions.com/products/1Password

this looks like it has some really nice organizing features, but it looks very proprietary... and it doesn't seem like there's any data portability, which I would think might be important for data like this....