Use KeePass. It's FOSS, has a great extension for FF, and stores your passwords in a local, encrypted file. No cloud necessary.
I use Keepass also, more specifically https://www.keepassx.org
Why not KeePassXC? https://keepassxc.org/docs#faq-keepassx
Ask HN: Does anyone use an alternative to a password manager?
51–60 of 250 posts
Re: Ask HN: Does anyone use an alternative to a password manager?
#52An idea for a side project I had for some time: Use Raspberry Pi Zero connected to the PC as a password manager . Explanation: RPi Zero supports OTG and can emulate USB keyboard (in other words, it can "type" your passwords for you).
Never got too deep into this idea, but it shouldn't be extremely hard to implement. Need to create some mechanism to allow the web browser to ask the RPi for a password for a certain site, and use GPIO to connect a LED Matrix display (16x2) plus some input method to allow the user to physically confirm the password request (possibly PIN entry or a simple yes/no button for simplified usage)
Re: Ask HN: Does anyone use an alternative to a password manager?
#53My alternative is believing that not all websites you log into pose the same risk to you and accepting some risk. This means I divide websites that require login into two categories:
1. I don't care if somebody gains access to my account
2. I do care if somebody gains access to my account
I use the same password for all the websites on the first category. It should be at least 8 characters long, consists of a made up word with some numbers and characters. Example: 7%Frifells. I drop the special character on websites that don't allow them in passwords and then it's a matter of failing to log in once and trying without it.
I use a different "xkcd" password (https://www.xkcd.com/936) for every website on the second one. Those are essentially catchphrases which I end up associating with the website I use them for. They consist of several words with numbers and special characters (using the example in xkcd, mine would be correctHorse?1batterystaple!).
So, I have to memorise about 8 passwords, all which make sense to me. In addition I have a password reminder file which consists of the website URL and the first two/three characters of the password. I don't bother adding completely unimportant websites from the first category.
If my password from category 1 gets compromised then it's a bit of a hassle to change the password on all the websites on the files, but no harm done. If a password from category 2 gets compromised then it doesn't affect the other websites.
---
I wish a lot of websites would realise they can be password-less. Pinterest is a good example. I have never posted anything, they don't have any personal or financial information from me and if and the only reason I registered was because I wanted to search something there once, and they made me register for that. Same goes to Quora and many other websites. I think all those should allow registering without a password but limit the functionality of those accounts.
---
Edit: formatting
Re: Ask HN: Does anyone use an alternative to a password manager?
#54I have a file on the local drive of my office computer and a sheet of paper near my home computer (used by me and my wife). When the sheet of paper is full of handwriting, I bring it to office to synchronize both list.. When my house has been robbed last year they have not found the sheet, but if they had, I could have changed all passwords very quickly. In case of fire, the backup is safe in a remote location. It is…
The actual attack to be worried about is that an adversary copies the sheet of paper without your knowledge. There's no need for an attacker to remove the physical list or to be a burglar. It could be someone you know.
Yes. I carefully lock my screen when I leave my office and the sheet of paper is not in plain sight.
Re: Ask HN: Does anyone use an alternative to a password manager?
#55I have a folder with encrypted text files containing a password for each service. It is available locally and backed up to the cloud (with another layer of encryption). The key is in my head, no backup. A script lists all files through fzf[1] which lets me find and select the right one very quickly, then copy to clipboard (expires after a few s). In a laptop the whole process of switching to terminal and grabbing a p…
Which encryption do you use?
AES256 using the system’s `OpenSSL`. I’d like to move to a self-contained executable with a more modern cipher but am wary of introducing too many home-brewed parts.
Re: Ask HN: Does anyone use an alternative to a password manager?
#56We really need passchange.js: an open source collection of headless JS scripts that can programmatically change your password on a given website. Then you would continuously rotate _all_ your managed passwords as well as your master. Not a panacea, but significantly minimizes the length of a theoretical breach.
Dashlane can change your password on a lot of sites. Unfortunately they do it server-side.
Re: Ask HN: Does anyone use an alternative to a password manager?
#57I used a small script to generate my passwords : I choose a simple password, I append the domain and I hash the string. I take the first 15 characters of the hash as a password. I find it quite convenient and easy to remember ! sha256("password"+domain)
So... your passwords are 15 characters of the combination 0-9, a-f?
Yes. But I do add a special characeter and/or a maj at a certain place when it is needed
Re: Ask HN: Does anyone use an alternative to a password manager?
#58I used a small script to generate my passwords : I choose a simple password, I append the domain and I hash the string. I take the first 15 characters of the hash as a password. I find it quite convenient and easy to remember ! sha256("password"+domain)
This seems like one of the simpler solutions on here, what's your process of dealing with sites that require special characters etc?
I add a special character at the end when it's needed
Re: Ask HN: Does anyone use an alternative to a password manager?
#59Always going to be a security/convenience tradeoff to some extent. If you expect to be targeted by The Baddies (tm), you want to tradeoff convenience for security. Spend some time every day memorizing long random strings and hope you never get hacked using the Wrench method[0]. If you're not expecting to be specifically targeted, then "modify a single password per service" can be surprisingly secure. Don't just add "…
> there is a valid argument that managers are not necessarily the best solution What is that argument?
"Depending on your usecase" - e.g. you use many devices, need your passwords on all of them, and don't trust any of the current password managers to do their job (which is valid due to the many breaches and vulns).
Re: Ask HN: Does anyone use an alternative to a password manager?
#60* descriptive, long passphrases, that I usually have no trouble remembering. e.g. Facebook could be "I talk to my friends".
* salt to make stupid password rules happy and to make it somewhat safe to write down passwords. e.g. "mysecretsalt42$". This gets appended to all passwords and doesn't get written down anywhere.
* encrypted text file, used rarely when I forget a password. e.g. `vim -x socialmedia.txt`. I find this a bit better than Keepass or pass because it's not one obvious attack target (both the file and app).
* optionally, a paper backup