Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 320 posts

Re: Ask HN: What is your password management solution?

#121

Post by dannysu »

roryisok wrote: post #84
dannysu wrote: post #38

Earlier quoted context omitted.

Paranoia Yeah, the KeePass database is encrypted and I secure it with both password and keyfile, but I still want something that won't leave my database "out there" available for bruteforce attempts or other attempts at it.

It's hardly "out there" though. A hacker would still need to hack dropbox before they could access your keepass db and begin brute forcing. What makes your own private server more secure than dropbox's network?

You're trusting them to not have issues like this: https://blogs.dropbox.com/dropbox/2011/06/yesterdays-authent...

I don't trust the servers (Dropbox or my), and thus I want it encrypted on my computer prior to sending it out on the Internet.

Re: Ask HN: What is your password management solution?

#122

Post by linsomniac »

dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

I used to do something very similar to this, for around 5 years. It works fairly well, but I've moved away from it largely because: There are always exceptions that won't work (you can't have one scheme that both satisfies "you must have one special character" and "you cannot have any special characters"), and it also doesn't let you change your password for a site. I was able to come up with something that worked in 95% of the cases, it was the 5% that got me to stop using it.

Re: Ask HN: What is your password management solution?

#123

Post by 6ak74rfy »

jzast2 wrote: post #17

https://www.lastpass.com Free to use, auto password generation, has an iOS app with thumb print unlock (saves you from typing in a long master password). I personally really enjoy it.

I don't understand the hate against Lastpass. Why would I trade it's awfully simple features (autofill on Android, automatically save/update passwords from website forms in browser, cheap etc.) for something like Keepass, even if the latter is purportedly a bit more secure? Some people also say that Lastpass's UI isn't great, but who cares about a password manager's UI as long as it does the job?

Re: Ask HN: What is your password management solution?

#124

Post by rkcf »

dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

This is my solution as well. I back it up to a sftp server to keep it synced across my devices.

Re: Ask HN: What is your password management solution?

#127

Post by z1mm32m4n »

linsomniac wrote: post #122
dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

I used to do something very similar to this, for around 5 years. It works fairly well, but I've moved away from it largely because: There are always exceptions that won't work (you can't have one scheme that both satisfies "you must have one special character" and "you cannot have any special characters"), and it also doesn't let you change your password for a site. I was able to come up with something that worked in…

That's what the incrementing variable is for. Of course, you have to then remember how many times you've changed your password for any given site.

Re: Ask HN: What is your password management solution?

#128

Post by fmariluis »

raamdev wrote: post #31
benjaminjosephw wrote: post #13

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/

+1 for `pass`. I wrote a handy Bash script [1] that lets me easily search my passwords without having an exact match (e.g., `fpass fin cap one` quickly finds my password info for "Financial/CapitalOne.gpg"). It makes pulling up passwords so much easier as I only need to remember fragments of how I stored it instead of trying to remember exact folders and names using auto-complete to find the password. I also use iTer…

> The only downside is no access from my phone

For iOS: https://github.com/mssun/passforios works really well and it's open source.

Re: Ask HN: What is your password management solution?

#129

Post by linsomniac »

richardpetersen wrote: post #7

Enpass all the way. Free and works with dropbox

I started using Enpass a few months ago and am mostly happy with it, but I'm not sure it'll work for me long term.

A few of the issues:

- It crashes periodically on Linux. Though it has never wedged the database.

- On ChromeOS, it is "supported" via the Android app, which does not integrate with the Browser plugin from what I can tell. I was really hoping for something that would work there.

- You can't have multiple password databases at all, from what I can tell. I'd really like something that could manage my personal passwords, work passwords that I share with 2 other people at work, and family passwords that are shared with my fiance'.

For the last decade I used a gpg encrypted file on my laptop, combined with passwords saved in the browser on my encrypted file-system. That worked fairly well, until I was in Mexico and my laptop decided to take a vacation too. I couldn't access ANY of my passwords until I got home and could get to my desktop or move my drive to another machine.

Enpass has some benefits:

- The syncing using Google Drive works well.

- Fingerprint unlocking of the vault on my phone works well.

- I've always had a pain point with apps on my phone that update and then need the password again (front door smart lock, car, bank), and I can't access them anymore until I get to my laptop and type in the 30 character random password.

- You can add fields to the records, the default "login" record has "security question" and answer, but for sites that have 3 security questions I can add them as custom fields. (My mothers maiden name? It's "mCxK7JszjJ5Mq29")

- It is available on Linux and Android and kinda on ChromeOS.

I do feel like a web-based one would work better with ChromeOS, but I'm still experimenting with whether ChromeOS can replace my laptop. I'm typing this on my laptop, so...

Re: Ask HN: What is your password management solution?

#130

Post by z1mm32m4n »

dheera wrote: post #80
microtonal wrote: post #63

Earlier quoted context omitted.

Disadvantages: - You have to keep track of n for every site. - If the master password is compromised, you have to change each password manually. - Not well-integrated with browsers. - Far less convenience on a phone.

> - You have to keep track of n for every site. I consider this far better than having to keep a password manager's database. n = 0 for the vast majority of sites without sensitive personal data. For the small handful that need to change, I usually sync them all to the same value of n about once or twice a year. > - Not well-integrated with browsers. I use Chrome's password-saving feature for websites that don't stor…

At this point, couldn't you keep the list of domains/n's in a plain text file? You still don't have the master password.
Post reply on HN