44 ms·

Sooooo... what's a good recommendation for an "offline" password manager (ie: one that connects via USB and requires physical input to "paste" the password)

eertami 11y ago
KeePassX
nilved 11y ago
KeePass, password-store
caskance 11y ago
Keepass or Password Safe
Nadya 11y ago
I suggest Enpass: http://www.enpass.io/ http://www.enpass.io/
Spooky23 11y ago
There is Password Safe, which has a few third party implementations. I believe they have Yubikey integration. Keepassx is cross platform, and supports keyfiles, which could be installed on removable media. Based on a paper I saw a few months ago, Password Safe's crypto looked to be better implemented.
hackuser 11y ago
Paper. Password Safe has (or had) Bruce Schneier's recommendation, for what that's worth. I think he helped design the original version, years ago. However, I think the key question is, what are you protecting? I doubt Schneier would recommend Password Safe, for example, for nuclear launch codes, but maybe your email password (depending on what's in your email).
e1ven 11y ago
1Password is available on OSX/iOS/Android/Win, but isn't available on desktop Linux. You can sync it with your phone over local wifi connections. It's not as secure as a pure-usb connection, but might be worth considering.
rodgerd 11y ago
Keepass and variants have served me well (as far as I know...)
ajross 11y ago
I've posted this before, but as the subject keeps coming up: (defun cc () "Secrets File" (interactive) (find-file "/home/ajross/.cc.gpg")) Launch with "M-x cc" and edit/copy as needed. Your Linux distro's GPG integration is going to cache the credentials appropriately even if you delete the buffer (which I usually do just out of irrational paranoia), so you can use a nice long pass phrase without hassle.
therealmarv 11y ago
Password manager file format comparison: https://news.ycombinator.com/item?id=9727522 https://news.ycombinator.com/item?id=9727522 According to this paper Password Safe is the best. But really bad it is mainly for Windows and only expensive 3rd party OS X client. So I'm stuck with KeepassX (btw. 2.0 beta 2 was recently released)
- tjl 11y ago
  That paper is pretty old now. If I remember right, it covered 1Password version 2. It's at version 5 now and it handles things different from before.
Buge 11y ago
Not exactly offline, but if you have a spare clean android device with internet access and a camera, you could use the app/website I created, https://throwpass.com https://throwpass.com . It allows you to send your password from your android device to any computer with a browser. It encrypts the password end to end with a public key generated in the browser and distributed to the device via qr code.
girzel 11y ago
I use "pass": http://www.passwordstore.org/ http://www.passwordstore.org/ Everything in GPG-encrypted files, in a git repo that I sync with my server. The GPG key is kept unlocked for an hour or so with gpg-agent, meaning I only type my key password a few times a day. All passwords copied and pasted from the shell, though I use Conkeror so there's no reason I couldn't write a little bit of integration to have the passwords pasted directly into the web forms.
- warmwaffles 11y ago
  I do the same here, though I have not pushed my keys to anywhere external just yet and I do not have my gpg kept unlocked for very long.
  - girzel 11y ago
    I keep the repo sync'd between two computers, and have even cloned it to my Android phone, but I haven't yet summoned the guts to actually put my PGP key on my phone so I can access my passwords there.

eertami 11y ago

KeePassX

nilved 11y ago

KeePass, password-store

caskance 11y ago

Keepass or Password Safe

Nadya 11y ago

I suggest Enpass: http://www.enpass.io/ http://www.enpass.io/

Spooky23 11y ago

There is Password Safe, which has a few third party implementations. I believe they have Yubikey integration. Keepassx is cross platform, and supports keyfiles, which could be installed on removable media. Based on a paper I saw a few months ago, Password Safe's crypto looked to be better implemented.

hackuser 11y ago

Paper. Password Safe has (or had) Bruce Schneier's recommendation, for what that's worth. I think he helped design the original version, years ago. However, I think the key question is, what are you protecting? I doubt Schneier would recommend Password Safe, for example, for nuclear launch codes, but maybe your email password (depending on what's in your email).

e1ven 11y ago

1Password is available on OSX/iOS/Android/Win, but isn't available on desktop Linux. You can sync it with your phone over local wifi connections. It's not as secure as a pure-usb connection, but might be worth considering.

rodgerd 11y ago

Keepass and variants have served me well (as far as I know...)

ajross 11y ago

I've posted this before, but as the subject keeps coming up: (defun cc () "Secrets File" (interactive) (find-file "/home/ajross/.cc.gpg")) Launch with "M-x cc" and edit/copy as needed. Your Linux distro's GPG integration is going to cache the credentials appropriately even if you delete the buffer (which I usually do just out of irrational paranoia), so you can use a nice long pass phrase without hassle.

therealmarv 11y ago

Password manager file format comparison: https://news.ycombinator.com/item?id=9727522 https://news.ycombinator.com/item?id=9727522 According to this paper Password Safe is the best. But really bad it is mainly for Windows and only expensive 3rd party OS X client. So I'm stuck with KeepassX (btw. 2.0 beta 2 was recently released)

tjl 11y ago
That paper is pretty old now. If I remember right, it covered 1Password version 2. It's at version 5 now and it handles things different from before.

Buge 11y ago

Not exactly offline, but if you have a spare clean android device with internet access and a camera, you could use the app/website I created, https://throwpass.com https://throwpass.com . It allows you to send your password from your android device to any computer with a browser. It encrypts the password end to end with a public key generated in the browser and distributed to the device via qr code.

girzel 11y ago

I use "pass": http://www.passwordstore.org/ http://www.passwordstore.org/ Everything in GPG-encrypted files, in a git repo that I sync with my server. The GPG key is kept unlocked for an hour or so with gpg-agent, meaning I only type my key password a few times a day. All passwords copied and pasted from the shell, though I use Conkeror so there's no reason I couldn't write a little bit of integration to have the passwords pasted directly into the web forms.

warmwaffles 11y ago
I do the same here, though I have not pushed my keys to anywhere external just yet and I do not have my gpg kept unlocked for very long.
- girzel 11y ago
  I keep the repo sync'd between two computers, and have even cloned it to my Android phone, but I haven't yet summoned the guts to actually put my PGP key on my phone so I can access my passwords there.