51–60 of 289 posts
Not sure it’s the best way to do it, security wise, but it’s what I found works for me in a security/convenience trade-off
https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…
Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.
Tangentially, if you precede a command with a space, then it won't show up in your shell history. (Double check to be sure, as this is likely a configurable option of your shell. e.g., 'histignorespace' in zsh.)
I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
A passsword manager (PM) makes random passwords easier. A PM keeps me from re-using passwords. A PM gives me a relatively secure place to store vital information, and it also lets me use it on multiple computers and stays in sync.
Do I trust them implicitly with everything? No. That would be foolish. It's a calculated risk, and the benefits outweigh the risks.
Because my passwords are stored in the cloud but they are only decrypted on my PC. If a nation state or another attacker gets into the password manager I use, they have my encrypted passwords just the same as if they rooted some Linux box I have an account on. The stakes are roughly the same. A passsword manager (PM) makes random passwords easier. A PM keeps me from re-using passwords. A PM gives me a relatively secu…
The point is, why do you believe it's true?
Because my passwords are stored in the cloud but they are only decrypted on my PC. If a nation state or another attacker gets into the password manager I use, they have my encrypted passwords just the same as if they rooted some Linux box I have an account on. The stakes are roughly the same. A passsword manager (PM) makes random passwords easier. A PM keeps me from re-using passwords. A PM gives me a relatively secu…
> they are only decrypted on my PC. The point is, why do you believe it's true?
Earlier quoted context omitted.
This is the only one I use. I've used it for like 5 years and have hundreds of passwords stored. Everything is offline and encrypted with GPG along with being command line driven. It's the ultimate tool for someone who primarily uses a workstation or laptop.
I have a few devices so I store the passwords as a git repo and periodically push/pull between them -- super seamless.
Earlier quoted context omitted.
> There are ways to store data securely, one of the simplest methods is to do zero-knowledge encryption of that data by way of key-generation from a password only the user knows at the time of decryption. This keeps your passwords save until you enter your master password. At that point you have to trust the software that was downloaded a few days ago from an appstore or a few seconds ago from the company webserver.…
Your argument has nothing to do with cloud storage or password managers generally and seems to be an argument against automatic updates. So, fine, disable automatic updates (although I'd argue you're safer with them). I also baked in the presumption that the software isn't malicious in my comment and called it out. So, sure, yes malware that leaks your password can exist. That doesn't really have any effect on whethe…