201–210 of 250 posts
For me, https://www.passwordstore.org/ and a Yubikey is the best setup I've tried. It's quite a lot of work to set it up though.
What if you lose your Yubikey?
See also best practices for backing up OpenPGP keys.
I use Linux, Windows, and Android. I decided on Pass [1] and it's been working really well for me. I have a dedicated PGP key that encrypts all my passwords, and they're stored on my own git server. On Linux I use the pass command, on Windows I use QtPass [2], and on Android I use Password Store [3] and OpenKeychain [4] (for the PGP key). My "master password" is the password for the PGP key, and I type it each time I…
Why use a PGP key instead of symmetric encryption (either with a random key encrypted with your master password, or a key derived from your master password)?
Earlier quoted context omitted.
Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to and even realize that your password has some sort of generation algorithm, but it would be a bit more secure to hash that password in some way. That's why I like using LessPass (even though people talk a bit of shit about it whenever it's mentioned on HackerNe…
> Doesn't this compromise all of your passwords if one of your passwords is discovered? I've been trying to understand password managers for a while. My workplace forces us to use one. But what you've said doesn't make sense. If your "master password" used in the password manager is discovered, then all your passwords are compromised. If my laptop or phone gets stolen and someone knows the password from my password m…
I also have it set to 2FA with google authenticate, so I need to have my phone everytime I log in. It takes longer to login but its worth it
So even if my password were compromised by a keylogger / brute force, you would still need to have access to my phone.
I don't use lastpass on my phone so that's not a nonissue for me. I don't link my phone to my computer at all (airdroid, teamviewer, etc). You would need to have
- My master lastpass password
- My unique phone password and my phone
Both events are kind of unlikely to happen. I worry more about lastpass leaking passwords than me being hacked at any point, since this is the major disadvantage of using lastpass over keepass.
lastpass is nice since I can just make autogenerated throwaway passwords and have a way to take notes on passwords I change over time
And if you use a password manager, please store your master password in a well-sealed envelope in a safe place for your loved ones to open in a worst-case scenario. All your passwords may be compromised if it's stolen, but at least you would know it happened and can change them.
Earlier quoted context omitted.
Your weakest link is probably now iCloud, considering how easily and often it gets hacked...
Which is never, right? Has iCloud actually been “hacked” in the “Yahoo” sense of the word? I ask because I use iCloud heavily. Nearly 1TB of photos/videos and now use 1Password with iCloud sync.
Has Apple made mistakes when designing iCloud, allowing unauthorized access to accounts? Yes.
I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…
Unless you are a high value target, there is a pretty good chance no one is sitting specifically bruteforcing your passwords.
Your biggest source of attack is then a password dump, where you are one of the many millions compromised and now your other accounts (if you reused the same password) are now vulnerable to automated attacks. Even in this case, no one is going to sit around trying to figure out your password algorithm.
Even when it comes to compromised accounts, not all of them are equal. For most people, their primary email, banking and social media accounts are paramount, because they are fundamentally linked to their identity (I would be horrified if my FB or GMail were to be compromised, but only mildly miffed if my etsy account where I have made one purchase were to be compromised).
All in all, it seems that the most important thing to do is to never reuse a password for ANY of your primary accounts (email, finance, social media, other forms of identity). Ideally for those, don't use an algorithm either. And set up 2FA for these.
And for other accounts, preferably never reuse passwords. Whether you use a password manager to manage them or an algorithm should not make too much of a material difference.
I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…
If the algorithm is not reversible, "one password is compromised, they all are" isn't true. Only if the master password is compromised, then all your passwords are (but this is exactly the same with any password manager.)
The one thing that personally I don't like about vaults is availability of my passwords. You need your password manager (i.e. the app) to get your passwords. I've had multiple situations, typically when traveling, where I didn't have access to my devices, and thus I didn't have the app.
I use a simple 'cipher' that makes new passwords easy to remember and remains relatively secure without the need of a book/service. I have a file of the first word that comes to mind for every letter in the alphabet. Then my password is created based on some features of the site. I.e. eBay has 4 letters so I could choose: 'Elephant_4_Yankee' The delimiter is up to you and you could just as easily choose every second…
Second this. Domain should generate chiper for a password. You get unique password for every website and you dont have to remember it
Create a few aliases in your shell and you have a very convenient, easy-to-use (for the HN crowd, anyways) tool.
Earlier quoted context omitted.
Why would you use an encrypted file when you have free, open source password managers like Keepass? Every time you login somewhere, you open the file, search for the site, copy the password and paste it in the browser? What do you do when you need a password on your phone? What do you do to clean your memory after the paste operation to reduce the likelyhood of memory trojans reading it?
> What do you do when you need a password on your phone? dl the file from dropbox and decrypt it via termux /s
At work, and with shared family accounts, I use 1Password; it works nicely and has a Web interface so I can use it from FreeBSD.
My personal workflow though is heavily Emacs-centric; I use Emacs for editing, programming, IRC, email, file management, PIM (orgmode), and (soon) Slack.