Of the open source password wallet solutions, which ones have actually been audited?
Ask HN: What is your password management solution?
171–180 of 320 posts
Re: Ask HN: What is your password management solution?
#172I'm using KeepassX with Dropbox. I store the database on Dropbox, so that it's available on my computers running different OSes (Ubuntu, Slackware, MacOS) and my phone at all times.
I'll probably get rid of Dropbox at some point, but I'll keep the same method, which gives me complete satisfaction.
Re: Ask HN: What is your password management solution?
#173Earlier quoted context omitted.
That's what the incrementing variable is for. Of course, you have to then remember how many times you've changed your password for any given site.
How does incrementing a counter address some sites requiring special characters while others reject them?
The counter only addresses requirements to change password periodically. The special character requirement is addressed by tacking on 'Aa$1' to all passwords (they asked for it; it's what I tacked to all the (good) passwords I memorized even before I had this method).
Re: Ask HN: What is your password management solution?
#174Enpass all the way. Free and works with dropbox
I'm a happy Enpass user too. The best thing I like about Enpass is it's built on Open Standard, you can decrypt the database file easily if Enpass dies
Re: Ask HN: What is your password management solution?
#175`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/
If you're not going to use 1Password, which is still the only commercial password manager I'll recommend, "pass" is probably your best alternative.
Re: Ask HN: What is your password management solution?
#176`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/
My main reason to not use pass is that I can't allow multiple private keys to unlock the password store. I don't want to transfer my private key between all my machines.
Re: Ask HN: What is your password management solution?
#177This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…
This is a long blog post that talks about some drawbacks of this approach: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...
Before reading this I was convinced that stateless deterministic approaches like these was the ideal. But some arguments in that post changed my mind.
Re: Ask HN: What is your password management solution?
#178Earlier quoted context omitted.
It's hardly "out there" though. A hacker would still need to hack dropbox before they could access your keepass db and begin brute forcing. What makes your own private server more secure than dropbox's network?
You're trusting them to not have issues like this: https://blogs.dropbox.com/dropbox/2011/06/yesterdays-authent... I don't trust the servers (Dropbox or my), and thus I want it encrypted on my computer prior to sending it out on the Internet.
I suppose it couldn't hurt!
Re: Ask HN: What is your password management solution?
#179Enpass all the way. Free and works with dropbox
I would be much more eager to use Enpass if they made the code available to people who pay.
They use SQLCipher which is OSS. I understand they don't release the UI code as it is what they use to make money. If you are afraid that they secretly copy your passwords you can easily check this. As you keep the file on your device or place it at a third party service it is more secure than a service like LastPass. Also don't use browser plugins but copy and paste the password
Re: Ask HN: What is your password management solution?
#180I have one simple master password. I modify it slightly based on the url of each website. I have a text file backed up on Dropbox with any special rules for the password on each website (e.g. "turbotax:
capitalized + bang").
Works great as long as you can resist the urge to tell other people about your system!