Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 320 posts

Re: Ask HN: What is your password management solution?

#31

Post by raamdev »

benjaminjosephw wrote: post #13

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/

+1 for `pass`. I wrote a handy Bash script [1] that lets me easily search my passwords without having an exact match (e.g., `fpass fin cap one` quickly finds my password info for "Financial/CapitalOne.gpg"). It makes pulling up passwords so much easier as I only need to remember fragments of how I stored it instead of trying to remember exact folders and names using auto-complete to find the password.

I also use iTerm2's system-wide hotkey [2] to quickly show/hide a dedicated terminal window that I use for retrieving passwords.

I've been using this setup for years now and I absolutely love it. The only downside is no access from my phone, but I always have my laptop with me and I memorize passwords that I frequently use.

1. https://github.com/raamdev/bin/blob/master/fpass

2. https://apple.stackexchange.com/a/48805

Re: Ask HN: What is your password management solution?

#32

Post by onetom »

Subscription to 1Password is not mandatory. Or at least it was not in the past. Without a subscription, you can create local vaults which can be synced via Dropbox, iCloud or over WiFi within the same subnet (which means over VPN too).

Here is some documentation on the Dropbox sync for example: https://support.1password.com/sync-with-dropbox/

Re: Ask HN: What is your password management solution?

#34

Post by sgt101 »

tentaTherapist wrote: post #22
paulpauper wrote: post #5

write it down and put piece of paper in pocket

Congratulations for having the patience to write out long strings of characters on paper and type them out repeatedly, but that doesn't sound very safe.

You can make it safe by using a secret key in conjunction with the keys. For example; all passwords as written but the third character must be # instead of what's written. This renders the book useless if stolen or copied.

If you keep the book in a locked draw and use some tell tails to ensure that you will know if it's been opened you have a strong chance of being able to know if you have been physically compromised.

Any online key store is vulnerable in a number of ways, end to end security is hard. The biggest issue is that your provider might be placed under significant physical pressure relieved only when your account is compromised.

And you will be unaware.

Re: Ask HN: What is your password management solution?

#35

Post by ameesdotme »

fredley wrote: post #24
jzast2 wrote: post #17

https://www.lastpass.com Free to use, auto password generation, has an iOS app with thumb print unlock (saves you from typing in a long master password). I personally really enjoy it.

Android version also the first thing I set up on a fresh phone. Fingerprint unlock, can input passwords directly into most apps (it matches sites to apps automatically) as well as Chrome.

Keep in mind that enabling the LastPass Accessibility service in Android disables device protection features (like storage encryption).

Re: Ask HN: What is your password management solution?

#36

Post by dannysu »

Jedd wrote: post #26
dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

Agreed on use of keepassxc - fantastic utility. I don't, and wouldn't, use dropbox or any other non-free non-self-hosted system to manage the storage or synchronisation of my secure data, so it's unison(rsync) and/or ssh'd between desktop and laptop.

If only there's a way to do that with my iPhone :(

Re: Ask HN: What is your password management solution?

#37

Post by rhlala »

dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

Why not use dropbox? It is only used for sync databases, not access them, I always though if someone found my keypass database encrypted it would be useless.

Re: Ask HN: What is your password management solution?

#38

Post by dannysu »

rhlala wrote: post #37
dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

Why not use dropbox? It is only used for sync databases, not access them, I always though if someone found my keypass database encrypted it would be useless.

Paranoia

Yeah, the KeePass database is encrypted and I secure it with both password and keyfile, but I still want something that won't leave my database "out there" available for bruteforce attempts or other attempts at it.

Re: Ask HN: What is your password management solution?

#40

Post by 3pt14159 »

I use this ruby script:

    print ((rand * 1_000_000_000).to_i.to_s + \
           ("a".."z").to_a.sample(10).join + \
           ("A".."Z").to_a.sample(10).join + "_")
It solves a number of annoyances. First, it's easy to type on mobile if you need to for some dumb website that clears your input field when you alt-tab, since it sticks to numbers, letters, then capitalised letters. It contains a non-alpha numeric character, but at the end for stupid forms that don't allow them.

As for keeping the passwords around, you can do one of a couple things, but I generally just forget the password after logging in with it everywhere. I'm signed into chrome, so what's the point in remember the password myself? Unless it's something sensitive I don't bother. It's easier to generate a new one than to dig it up.

Post reply on HN