31–40 of 289 posts
https://www.passwordstore.org/
https://www.passwordstore.org/
This is the only one I use. I've used it for like 5 years and have hundreds of passwords stored. Everything is offline and encrypted with GPG along with being command line driven. It's the ultimate tool for someone who primarily uses a workstation or laptop.
IMO it's strange that people use cloud-based password managers. Companies like 1Password have all your passwords in their cloud. So they are an enormous target. I use enpass, and am in charge of my own syncing and storing in the datastore of my choice. I personally prefer this model.
> Companies like 1Password have all your passwords in their cloud. But they are end-to-end encrypted, so if someone broke into their database they would be useless unless they also had access to your device.
gpg "make-key"
mkdir -p ~/.passwordstore/foo/bar
echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg
gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg
tree ~/.passwordstore/
--
Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integration for syncing).
There's another plugin: "password-tomb" which basically adds in a "zip -r tomb.zip ~/.passwordstore && unzip tomb.zip" with some extra encryption blobbing around things.
I'm nudging towards wanting all that "junk" stored on a mostly-offline (or read-only USB, or doing something with fetching encrypted secrets over the network), and trying to figure out in a temporary ram-disk to try and reduce exposure-time.
The reason it feels pretty good for me is that it degrades gracefully and can be used with standard tooling. It's totally possible to have a script which does: "foreach password => unlock && dump && append-to-pdf && qr-code => print.pdf" and print that out at intervals, so it's got great survivability characteristics. It allows me to self-host even completely offline using git. If I have the GPG key, I can recover the passwords w/o any tooling. Really it's kindof my ideal situation for trustworthiness.
Because if you don't use one, you'll almost certainly instead either reuse passwords across sites, store passwords insecurely, or choose weak passwords.
In my opinion, storing passwords in encrypted files is probably safer than putting passwords in a centralized location (provided you don't code your own encryption algo or make other silly mistakes). There is not a lot of value in trying to attack a single person's password file, but the value is multiplied by the number of users when using a centralized platform.
I'm surprised by so many of the comments here out-of-hand dismissing or denigrating any password manager that stores data in the cloud. There are ways to store data securely, one of the simplest methods is to do zero-knowledge encryption of that data by way of key-generation from a password only the user knows at the time of decryption. This is essentially how the vault functionality of most password managers work, w…
This keeps your passwords save until you enter your master password. At that point you have to trust the software that was downloaded a few days ago from an appstore or a few seconds ago from the company webserver. It might have been backdoored and happily phone home your master password.
Your downloaded password manager might be a few years old and YOU decide when to upgrade.
I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
For most people, the biggest threats that come from passwords are: data breaches (compromising reused passwords), human memory limits (you can't remember high entropy passwords easily, in general), and an ever-increasing demand for both high quality passwords and unique passwords.
If you look at these threats from the perspective of most people, a password manager works well! You don't have to worry about breaches, memory limits, or even password generation. You can just generate-and-store random passwords for every site that meets their requirements, and walk away.
But that doesn't mean that that's the end of threat modeling. Other risks that you're probably thinking of are the security of the cryptosystem involved, bugs in the application, and fear of backdoors. These are valid threats, but for the vast majority of people, they're mitigated by other reasons, or are non-factors.
To give an example: a password manager that most cryptographers would laugh at is writing your passwords on a sticky note. Yes, that's bad from a cryptography standpoint, but if you make a new unique password for each site, and each one is sufficiently long and complex, you've actually mitigated the threats involved with password reuse, memory, and complexity. But you've also made it impossible to steal from a cryptography backdoor, and the barrier-to-compromise involves your physical space being violated. But again, if you ask a cryptographer, or even most security professionals, this is a bad idea, because you're still risking physical compromise if...you work in an office, have kids, don't guard your home, etc.
A lot of people dislike 1Password's decision to store passwords in cloud storage. This is a real risk, because a cryptosystem backdoor would create danger. If you use a password storage app with strong cryptography, and store the passwords in a completely benign location (e.g., a network share, some random cloud storage provider), you can decouple the cryptography from the storage, which brings some safety.
Now, back briefly to your question: why would people trust a completely SaaS password storage provider? Well, for me, it's that I know that Google Project Zero exists, and they do a lot of research into third party apps. I sleep easier at night knowing that lots of smart people are invested in trying to break 1Password's cryptography, and have thus-far been unsuccessful. Sure, a government might have a secret backdoor that I don't know about. But in my threat model, the government could just come arrest me for violating a non-disclosure agreement I've signed, and hit me with a wrench.
In summary: for the vast majority of people, the threats that come from "memorizing passwords" are mitigated by password managers. Heck, you even say you have your "own methods for safe handling of passwords". I would argue that you have a password manager, it's just more DIY than something off-the-shelf, and that's fine!
IMO it's strange that people use cloud-based password managers. Companies like 1Password have all your passwords in their cloud. So they are an enormous target. I use enpass, and am in charge of my own syncing and storing in the datastore of my choice. I personally prefer this model.
> Companies like 1Password have all your passwords in their cloud. But they are end-to-end encrypted, so if someone broke into their database they would be useless unless they also had access to your device.
I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
Same here. KeePassXC, sync manually and backup it manually. I don't trust SaaS as well.