I just do it the old-fashioned way: memorisation.
Ask HN: How do you manage your passwords in 2023?
151–160 of 179 posts
Re: Ask HN: How do you manage your passwords in 2023?
#152I use keepassxc to store my password. The Android app syncs with a file stored on my home server via SSH. No need to sync it manually, the Android app automatically checks for remote changes and copies the file over when you make changes on the app. The password file on my server resides in a folder that's synced across all my computers using syncthing. My home server also runs an OpenVPN server so all my devices can…
Why not only syncthing? That's what I've been doing to sync across devices (Android, Linux and Mac).
Mostly for legacy reasons... my KeepassXC Android ssh setup predates setting up syncthing. I suppose I could change it to syncthing but it works well as is and there's no real reason to.
Re: Ask HN: How do you manage your passwords in 2023?
#153Before I used password managers I would just keep a monolithic text file with all the relevant information for sites and password and also keep notes. I was using vim encryption at the time. This was a bad idea because the vim encryption doesn't really follow cryptography best practices for example the encryption isn't authenticated.
The first password manager I started with is LastPass in 2014 when it was recommended to me by a password security expert in academia. I used a memorable human generated passphrase with enough twists to get about 80 bits of entropy, so if my old encrypted data is in the wild (doubtful), I'm not really concerned about the recent breach.
I've since been all in on 1Password since 2017 after LastPass was getting progressively worse and I sought out a new password manager. I've examined the security design whitepaper and most of the choices when it comes to cryptographic protocol design is pretty good, no real homebrew and should stand the test of time, but there's still better choices that can be made about protocols such as PAKE that'd be better in 2023. Anyways, 1Password UI is pretty good.
I also make backups of 1Password using the command line interface incase they decide to kick me off their systems or something happens where I can't make payments for years. The backups are then encrypted using the scrypt tool.
If I was to get off password managers completely, I wouldn't bother with these password management tools like Keepass etc. as they constrain you to their UIs and don't do an adequate job of doing things like browser autofills. I'd rather just go back to a plaintext file and encrypt/decrypt with scrypt or age.
Re: Ask HN: How do you manage your passwords in 2023?
#154If I can piggyback on this question, what do people do about those infernal security questions? Browsers don't help much with them.
Re: Ask HN: How do you manage your passwords in 2023?
#155Anyone here use GNU Pass? Can you describe your setup? Would it be an upgrade coming from KeepassXC?
Re: Ask HN: How do you manage your passwords in 2023?
#156I store my credentials in plain text files on an encrypted disk image, and I back them up onto an ironkey. Secure and easy to use? Seems so! But it's not especially easy to access on multiple devices, and that's by design. As a rule I don't want my personal data living on hardware which belongs to my employer, and phones are too easily lost or stolen. For everything else, there's scp or thumb drives.
Online password managers never made much sense to me; one by one, they eventually all get hacked. And why not? A centralized service storing thousands of people's credentials makes a great big juicy target. Their security is undoubtedly better than mine, but my personal laptop is not likely to be worth anyone's time.
For the same reason, I don't let browsers store passwords either.
Re: Ask HN: How do you manage your passwords in 2023?
#157LastPass, which can’t be spelled without a-l-a-s.
Re: Ask HN: How do you manage your passwords in 2023?
#158Earlier quoted context omitted.
I run Vaultwarden and still buy a license. I wish they’d offer an optional self-hosted license specifically for those who want to support the project while hosting their own server.
Are you buying a license just to support BW? Or is there any other benefit?
Not them, but vaultwarden doesn't accept the license file, so it's surely just to support. I'm planning on doing the same thing at some point.
Re: Ask HN: How do you manage your passwords in 2023?
#159I store my credentials in plain text files on an encrypted disk image, and I back them up onto an ironkey. Secure and easy to use? Seems so! But it's not especially easy to access on multiple devices, and that's by design. As a rule I don't want my personal data living on hardware which belongs to my employer, and phones are too easily lost or stolen. For everything else, there's scp or thumb drives. Online password…
You don't have to get an online one. There are offline ones like KeePassXC which are a lot more convenient to use than a file.
Re: Ask HN: How do you manage your passwords in 2023?
#160Buttercup[1] is a highly usable password manager that supports multiple storage backbends.
It has clients for desktop on Linux, Mac, and Windows, and it's got Apple and Android mobile clients. There's also a browser plugin. I've had a great experience so far.
I also use KeepassX, though it's a lot less usable / portable.
References: 1: https://buttercup.pw