5 ms·

Well-written article and some things I had thought of myself but ignored. It's not that other systems might be more secure, but reducing attack surface is impor

by cheez 11y ago

Well-written article and some things I had thought of myself but ignored. It's not that other systems might be more secure, but reducing attack surface is important. So, is there something that lets me access my passwords on all my computers and phones without having to manually sync? Perhaps something + Dropbox?

tmikaeld 11y ago
Well there is http://www.passwordstore.org http://www.passwordstore.org that haven't been cracked yet (Afaik).
- Edholm 11y ago
  Since it uses PGP, it is a bit cumbersome to use on smart phones. At least I thought so
  - rys 11y ago
    I've just noticed that the linked iOS app -- https://github.com/rephorm/pass-ios#readme https://github.com/rephorm/pass-ios#readme -- is no longer there. Not sure if it has a new home somewhere else.
    - tmikaeld 11y ago
      Hm, looks like the developer didn't have time to maintain it. Hardly any commits to github recently.
  - tmikaeld 11y ago
    Yeah, that's the gripe i have with pass - while it's probably safe(ish) to use, it's far from being as user friendly as lastpass.
distances 11y ago
I've been using Dropbox/ownCloud + KeePassX/KeePassDroid for years now. Putting the password in is a manual step, but that also means I feel like being more in control. Very happy with the setup.
- noja 11y ago
  I'd like the password store as a separate process, where I can allow a single password to leave the password store, after I okay it.
- neuro_imager 11y ago
  As someone with very little knowledge of encryption etc. please advise - how safe is dropbox? I would have guessed it would be a relatively frequent target for blackhats.
  - 4096 11y ago
    I would consider it not safe because it was on of the companies mentioned on the NSA slides. You can still sync your Keepass(x) file with Dropbox if you have a good password (key file is recommended) on the database file. Instead of Dropbox you can also use https://spideroak.com/ https://spideroak.com/ They have a really handy program which let you control a lot of things and they are a "zero knowledge" cloud provider, all your data is encrypted. Snowden recommends them: http://www.theguardian.com/technology/2014/jul/17/edward-snowden-dropbox-privacy-spideroak http://www.theguardian.com/technology/2014/jul/17/edward-sno... For $12 dollar a month you get 1 TB, which you can use as a safe off-site backup location.
    - gecko 11y ago
      Note that, while SpiderOak is arguably more secure than Dropbox, they rely on a hybrid security model wherein they still have your encryption key on their server, but encrypted with your local password. This matters because if your password is ever compromised, however briefly—say, by using the mobile app or the website, neither of which are supported in a secure manner (they make this very clear)—then all your data would be permanently compromised, with no way to rotate your keys and re-encrypt your data before someone gets access to it, short of blowing out your account. I get why things work this way, but still, yuck.
      - tombrossman 11y ago
tobtoh 11y ago
1Password allows this - 1Password+Dropbox is how I manage my passwords.
- darrmit 11y ago
  +1 for 1Password. I guess it gets no love because it's proprietary, but the security design is public and even when a "flaw" was uncovered a few years ago it was nowhere near this kind of revelation. I have tried KeePass, but it's just too painful to keep running..especially as a Mac user. 1Password + Dropbox with 2FA makes me sleep a lot better than when I used LastPass.
  - lobster_johnson 11y ago
    1Password's UI is so much nicer, too. It's a native, very good-looking app on OS X. The browser integration looks near-native and performs all interactions inside its dropdown menu. LastPass opens separate tabs to accept your master password or your 2FA token (at least in Safari), and things like editing a site or copying a password frequently takes you away from the tab of the site itself. Another huge advantage is that unlike LastPass, form field autofill actually works. It will even submit the login form by default, if there are no other fields that need to be filled out.
mr_sturd 11y ago
I have been using Syncthing on my desktop machines to share my KeePass database between them. My home server keeps a copy available via SFTP, which is accessible using the KeePass2Android app. That saves me the manual process of updating on my phone, allowing me to avoid using Syncthing, there, which would crush the battery.
sofaofthedamned 11y ago
Mitro is really good, probably overkill for what you want though. When it was bought by Twitter they open-sourced it with bits missing. Some have added the missing bits to run it in Docker, but there may be dragons: https://github.com/servomac/mitro https://github.com/servomac/mitro (comes with browser extensions, server, etc etc)
symmetricsaurus 11y ago
I know that this isn't what you asked for but one way to dramatically reduce the attack surface is to not upload your passwords anywhere and not sync them between devices. Just keep the passwords on your phone (in a password manager) and type them by hand on your computer. It works well enough since you always keep your phone with you (at least I do).
daveguy 11y ago
I have had a good experience with passpack. They use multiple layers of encryption (password for the site, and separate for encrypting passwords). I also have two factor identification set up. Access to the web site to copy paste pws is easy whether you are on a phone or desktop.
- ams6110 11y ago
  I like and use passpack. I don't completely trust so my primary email and bank passwords are stored only in my brain.
rmurri 11y ago
Look at https://enpass.io/ https://enpass.io/

by cheez 11y ago

tmikaeld 11y ago

Well there is http://www.passwordstore.org http://www.passwordstore.org that haven't been cracked yet (Afaik).

Edholm 11y ago
Since it uses PGP, it is a bit cumbersome to use on smart phones. At least I thought so
- rys 11y ago
  I've just noticed that the linked iOS app -- https://github.com/rephorm/pass-ios#readme https://github.com/rephorm/pass-ios#readme -- is no longer there. Not sure if it has a new home somewhere else.
  - tmikaeld 11y ago
    Hm, looks like the developer didn't have time to maintain it. Hardly any commits to github recently.
- tmikaeld 11y ago
  Yeah, that's the gripe i have with pass - while it's probably safe(ish) to use, it's far from being as user friendly as lastpass.

distances 11y ago

I've been using Dropbox/ownCloud + KeePassX/KeePassDroid for years now. Putting the password in is a manual step, but that also means I feel like being more in control. Very happy with the setup.

noja 11y ago
I'd like the password store as a separate process, where I can allow a single password to leave the password store, after I okay it.
neuro_imager 11y ago
As someone with very little knowledge of encryption etc. please advise - how safe is dropbox? I would have guessed it would be a relatively frequent target for blackhats.
- 4096 11y ago
  I would consider it not safe because it was on of the companies mentioned on the NSA slides. You can still sync your Keepass(x) file with Dropbox if you have a good password (key file is recommended) on the database file. Instead of Dropbox you can also use https://spideroak.com/ https://spideroak.com/ They have a really handy program which let you control a lot of things and they are a "zero knowledge" cloud provider, all your data is encrypted. Snowden recommends them: http://www.theguardian.com/technology/2014/jul/17/edward-snowden-dropbox-privacy-spideroak http://www.theguardian.com/technology/2014/jul/17/edward-sno... For $12 dollar a month you get 1 TB, which you can use as a safe off-site backup location.
  - gecko 11y ago
    Note that, while SpiderOak is arguably more secure than Dropbox, they rely on a hybrid security model wherein they still have your encryption key on their server, but encrypted with your local password. This matters because if your password is ever compromised, however briefly—say, by using the mobile app or the website, neither of which are supported in a secure manner (they make this very clear)—then all your data would be permanently compromised, with no way to rotate your keys and re-encrypt your data before someone gets access to it, short of blowing out your account. I get why things work this way, but still, yuck.
    - tombrossman 11y ago

tobtoh 11y ago

1Password allows this - 1Password+Dropbox is how I manage my passwords.

darrmit 11y ago
+1 for 1Password. I guess it gets no love because it's proprietary, but the security design is public and even when a "flaw" was uncovered a few years ago it was nowhere near this kind of revelation. I have tried KeePass, but it's just too painful to keep running..especially as a Mac user. 1Password + Dropbox with 2FA makes me sleep a lot better than when I used LastPass.
- lobster_johnson 11y ago
  1Password's UI is so much nicer, too. It's a native, very good-looking app on OS X. The browser integration looks near-native and performs all interactions inside its dropdown menu. LastPass opens separate tabs to accept your master password or your 2FA token (at least in Safari), and things like editing a site or copying a password frequently takes you away from the tab of the site itself. Another huge advantage is that unlike LastPass, form field autofill actually works. It will even submit the login form by default, if there are no other fields that need to be filled out.

mr_sturd 11y ago

I have been using Syncthing on my desktop machines to share my KeePass database between them. My home server keeps a copy available via SFTP, which is accessible using the KeePass2Android app. That saves me the manual process of updating on my phone, allowing me to avoid using Syncthing, there, which would crush the battery.

sofaofthedamned 11y ago

Mitro is really good, probably overkill for what you want though. When it was bought by Twitter they open-sourced it with bits missing. Some have added the missing bits to run it in Docker, but there may be dragons: https://github.com/servomac/mitro https://github.com/servomac/mitro (comes with browser extensions, server, etc etc)

symmetricsaurus 11y ago

I know that this isn't what you asked for but one way to dramatically reduce the attack surface is to not upload your passwords anywhere and not sync them between devices. Just keep the passwords on your phone (in a password manager) and type them by hand on your computer. It works well enough since you always keep your phone with you (at least I do).

daveguy 11y ago

I have had a good experience with passpack. They use multiple layers of encryption (password for the site, and separate for encrypting passwords). I also have two factor identification set up. Access to the web site to copy paste pws is easy whether you are on a phone or desktop.

ams6110 11y ago
I like and use passpack. I don't completely trust so my primary email and bank passwords are stored only in my brain.

rmurri 11y ago

Look at https://enpass.io/ https://enpass.io/