21–30 of 250 posts
Not a panacea, but significantly minimizes the length of a theoretical breach.
Always going to be a security/convenience tradeoff to some extent. If you expect to be targeted by The Baddies (tm), you want to tradeoff convenience for security. Spend some time every day memorizing long random strings and hope you never get hacked using the Wrench method[0]. If you're not expecting to be specifically targeted, then "modify a single password per service" can be surprisingly secure. Don't just add "…
What is that argument?
I let Keychain (MacOS) remember the passwords, so I never really think about them.
An example line in the text file looks like this:
facebook password: [base64:U2FsdGVkX1/T8CoWmfDOoaapE5lGj/fqHE3s8NohnriGajnPrCzWikCneU/u7]
echo "$data" | openssl enc -d -aes-256-cbc -a -salt -pass env:MY_PASS
Since the text file is encrypted, I store it on Dropbox. Then I can access this from any computer where I log into Dropbox, provided I know my main password for decryption.
Later I can type 'get facebook pass' on the command line and the get script will retrieve the best matching entry, decrypt the value, and put it in my copy paste buffer ready to paste.
The biggest problem with this system is sometimes when two or more entries are a close match to whatever keywords I input, it may pick the wrong match. I need to improve it to show a list to pick from in those cases, or work on better ways to remember the right keywords for each item. Also my matching heuristics could be improved.
I use this in conjunction with a command line script for generating strong passwords. Most accounts have different passwords at this point and they are all strong. One problem with the script is I sometimes have to tweak the resulting password by hand to match whatever (generally dumb) rules are in place at a new site... when I say dumb, I mean for example, '!' not allowed, etc.
For sharing web passwords with my phone, I just allow Safari to remember them and then trust iCloud, for better or worse.
Overall this is not a pain, and pretty successful. But if someone got terminal access in my account on my computer, it would be game over... so I try not to allow that.
I have a file on the local drive of my office computer and a sheet of paper near my home computer (used by me and my wife). When the sheet of paper is full of handwriting, I bring it to office to synchronize both list.. When my house has been robbed last year they have not found the sheet, but if they had, I could have changed all passwords very quickly. In case of fire, the backup is safe in a remote location. It is…
If I need to see the password for some reason you can find it from browser settings.
I've used supergenpass[1] with some success, but the fact that some websites have special requirements for passwords means that I still have to memorize more than one password. 1: https://chriszarate.github.io/supergenpass/
I use https://www.passwordstore.org/ .
I'd rather propse to use a self-hosted password manager on a VPS or in a cloud service.
As long as that password manager is hosted securely, VPS for example, and uses your login password to help decrypt the stored passwords.
Perhaps some HMAC required too.
Anyone know if this exists in the open source world?