Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 320 posts

Re: Ask HN: What is your password management solution?

#191

Post by inertial »

benjaminjosephw wrote: post #13

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/

Switched from pass to gopass recently : (https://github.com/justwatchcom/gopass). It's open source and has a tad bit more features over pass. Some of the reasons for my choice to switch:

- compatible with pass

- support for multiple stores

- store binary data (e.g. QR codes for seeding 2FA) : upcoming

- report / track issues on github.com/justwatchcom/gopass/issues

- more details here : https://www.justwatch.com/gopass/docs/

Re: Ask HN: What is your password management solution?

#192

Post by bgrohman »

rekshaw wrote: post #109
bgrohman wrote: post #98

I switched from LastPass to KeePassXC a few months ago after reading about some LastPass security problems. I really like KeePassXC.

As I am currently a LastPass user, could you fill me in on the security problems?

Sure, take a look on Google's Project Zero and search for "LastPass":

https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

Or search the news for LastPass security issues:

https://duckduckgo.com/?q=lastpass+security+issues&t=iphone&...

Re: Ask HN: What is your password management solution?

#193

Post by latkin »

1Password synced w/ Dropbox. Using Windows, MacOS + Android support. Very unhappy about the recent push toward subscription-based model, though, so I'm starting to look around for something new. Lots of good options in this thread.

For those in need of a cross-platform (Windows, Mac, Linux), open source 1Password CLI client, check out https://github.com/latkin/1poshword (disclaimer: my project)

Re: Ask HN: What is your password management solution?

#194

Post by dheera »

chilicuil wrote: post #183
dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

You shouldn't use hash functions designed for integrity, they're fast, fast is bad for password hashing, a single AMD graphics card can compute 200M guesses per second for single sha-512 iterations, instead use bcrypt, scrypr or any other hash function specifically designed for key stretching. https://hashcat.net/hashcat/ https://en.m.wikipedia.org/wiki/Key_stretching

Yep, I'm using pbkdf2-hmac-sha256 which is not just sha-256. The 2nd link you posted mentions pbkdf2.

Re: Ask HN: What is your password management solution?

#195

Post by earenndil »

enzolovesbacon wrote: post #47
raamdev wrote: post #31

Earlier quoted context omitted.

+1 for `pass`. I wrote a handy Bash script [1] that lets me easily search my passwords without having an exact match (e.g., `fpass fin cap one` quickly finds my password info for "Financial/CapitalOne.gpg"). It makes pulling up passwords so much easier as I only need to remember fragments of how I stored it instead of trying to remember exact folders and names using auto-complete to find the password. I also use iTer…

Oh my ZSH ( http://ohmyz.sh/ ), if you use zsh of course, has autocomplete, so folders and GPG files are only a few tabs away.

Don't need omz for autocomplete, it's already there in zsh. I TBH don't really like omz. It feels bloated, and I don't really need anything else on top of the already-awesome zsh.

Re: Ask HN: What is your password management solution?

#197

Post by grigory »

I use passpack to generate/store passwords, remember them in Firefox, and let Firefox Sync get them onto my different devices. Works pretty well!

My host of devices includes multiple laptops (Linux, OS X) and many different phones - both Android and iOS. Since Firefox runs everywhere, this works nicely. Firefox Sync has end-to-end encryption, but data stored at-rest on devices is guarded purely by physical access, which is fine for my use cases.

Re: Ask HN: What is your password management solution?

#199

Post by daleswanson »

dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

I recently did a bunch of research into password managers, and went with Keepassxc as well. I'm using Syncthing to sync the password archive across Linux, Mac, Android, and Windows devices. The whole setup is working very well and is all open source.

Re: Ask HN: What is your password management solution?

#200

Post by [deleted] »

grigory wrote: post #197

I use passpack to generate/store passwords, remember them in Firefox, and let Firefox Sync get them onto my different devices. Works pretty well! My host of devices includes multiple laptops (Linux, OS X) and many different phones - both Android and iOS. Since Firefox runs everywhere, this works nicely. Firefox Sync has end-to-end encryption, but data stored at-rest on devices is guarded purely by physical access, wh…

[deleted]
Post reply on HN