Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 320 posts

Re: Ask HN: What is your password management solution?

#221

Post by spapas82 »

raziel2p wrote: post #176
benjaminjosephw wrote: post #13

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/

My main reason to not use pass is that I can't allow multiple private keys to unlock the password store. I don't want to transfer my private key between all my machines.

Why not transfer the private key? I encrypted it using a one-time pass and send it using email. I then decryped and installed to the other machine.

Since I don't have the one time pass anymore the encrypted file is not usable anymore and I have the same key to both machines.

Please explain any holes with that flow.

Re: Ask HN: What is your password management solution?

#224

Post by philsnow »

inertial wrote: post #191
benjaminjosephw wrote: post #13

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/

Switched from pass to gopass recently : ( https://github.com/justwatchcom/gopass ). It's open source and has a tad bit more features over pass. Some of the reasons for my choice to switch: - compatible with pass - support for multiple stores - store binary data (e.g. QR codes for seeding 2FA) : upcoming - report / track issues on github.com/justwatchcom/gopass/issues - more details here : https://www.justwatch.com/go…

fun fact: 2FA QR codes contain the secret as just part of a url. you don't need to save the binary image, just figure out what the (usually base32-encoded) secret value is, and store that. google authentcator lets you type in the base32-encoded secret (useful if your phone's camera is broken). see e.g. https://garbagecollected.org/2014/09/14/how-google-authentic...

Re: Ask HN: What is your password management solution?

#225

Post by nialv7 »

Jedd wrote: post #26
dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

Agreed on use of keepassxc - fantastic utility. I don't, and wouldn't, use dropbox or any other non-free non-self-hosted system to manage the storage or synchronisation of my secure data, so it's unison(rsync) and/or ssh'd between desktop and laptop.

I store my password file on my phone, and use KDEConnect to access it on my desktop when needed.

Re: Ask HN: What is your password management solution?

#226

Post by badpenny »

tptacek wrote: post #217
chaitanya wrote: post #215

Earlier quoted context omitted.

As a LastPass user, any particular reasons why I should avoid them? Is it down to all the security issues they've faced lately?

1Password is the only commercial password manager I recommend, but I'll go further than that when it comes to LastPass and say: I really think you should avoid LastPass, and, if you're using it, migrate to something else. I'm not going to go into details, sorry.

LastPass is the only commercial password manager I recommend. I really think you should avoid 1Password.

I'm not going to go into details, sorry.

Re: Ask HN: What is your password management solution?

#227

Post by cmcginty »

I use MacPass (KeePass OS X client) and sync the DB with a (2FA enabled) Box Sync account.

I use the Chrome ChromIPass plugin for user/passwords autofill. There is also a FF plugin, but I usually stick with Chrome these days.

I tried to switch to Lastpass but I found that a) the plugin was a terrible resource hog and b) would make some sites unusable due to ridiculous page load times. Obviously it works for some people, but the attack vector of sites like LastPass are so large, I was never comfortable following the masses.

Re: Ask HN: What is your password management solution?

#230

Post by ekimekim »

inertial wrote: post #191
benjaminjosephw wrote: post #13

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/

Switched from pass to gopass recently : ( https://github.com/justwatchcom/gopass ). It's open source and has a tad bit more features over pass. Some of the reasons for my choice to switch: - compatible with pass - support for multiple stores - store binary data (e.g. QR codes for seeding 2FA) : upcoming - report / track issues on github.com/justwatchcom/gopass/issues - more details here : https://www.justwatch.com/go…

The original pass seems to handle binary data fine:

    $ pass insert -m mybinarysecret secret.png
Admittedly, it's not very user-friendly, but some simple wrapper scripts could fix that.
Post reply on HN