41–50 of 212 posts
Anybody else here simply hashing their master password with the domain name of the website? I think this is something the browser should offer by default.
Earlier quoted context omitted.
Clearing the clipboard protects against the user. A password manager effectively can't protect against other applications on the same machine. IMO that makes the universality of the clipboard more valuable than the safety of using alternate input methods. Though since there are plenty of things that block pasting passwords, those alternate options are appreciated.
to be honest, I can trust myself with clipboard but not what is running on my machine.
Anybody else here simply hashing their master password with the domain name of the website? I think this is something the browser should offer by default.
Anybody else here simply hashing their master password with the domain name of the website? I think this is something the browser should offer by default.
If your master password leaks you are exposed on every website where you used this scheme (and you should then change every password), so on the security side this is inferior to a master password granting access to uncorrelated passwords.
I know, it's not perfect, but it beats carrying around password files between devices.
Other things I do:
* store all the files as .toml files so I can rip specific keys with a custom script.
* Have a directory for web so `pass web` will give me all websites. Have a script to fill username pass for each.
* Have a directory for contacts. Then wrote a script to generate vCard files by crawling and pulling keys, base64 profile images and all.
* use syncthing to keep all devices up to date.
It's pretty slick workflow IMHO
Anybody else here simply hashing their master password with the domain name of the website? I think this is something the browser should offer by default.
Pass is pretty awesome, but nowadays I've switched to gopass: https://github.com/justwatchcom/gopass - much better support for teams, structured secrets, binary secrets and quite a few other improvements. Oh, and it's (mostly) drop-in compatible.
Looks nice. Unfortunately I would never use it for teams as it doesn't have audit logs. These are very useful in case a user is compromised - you can lookup which passwords he accessed and only change those. Same goes if the user left the team and u want to make sure all accesses are revoked.
Really? What if s/he just decrypted the file themselves and had a look at the content, rather than using the convenient wrapper that a password manager provides?