5 ms·
Practically, if one doesn't use a password manager, they probably have a much more serious problem than weak passwords, i.e. password re-use.
by sfilargi 10y ago
Practically, if one doesn't use a password manager, they probably have a much more serious problem than weak passwords, i.e. password re-use.
- kevin_thibedeau 10y agoAs opposed to having your manager DB lost or compromised by a trojan.
- danjoc 10y agoUsing zx2c4 pass with a Yubikey 4. Passwords are GPG encrypted. The private key is on the Yubikey and cannot be read out. The Yubikey 4 is set to require a touch per password unlock. The only passwords at risk are the ones unlocked. At that point, the trojan could install a keylogger and have the same amount of success. Losing the password store isn't a problem either. It has a git remote on a USB stick. There's a backup if it's ever lost.
- DanBlake 10y agoThis is interesting. I am not well versed on yubikey, but does it allow you to have a similar setup with other password managers, like keepass? (Meaning, one press per one password) Or is it just a substitute for typing a master password?
- danjoc 10y agoThere are several integrations, but I don't have Google Play Services on my phone, so I only use what's available via F-Droid. See my other comment in this thread. https://www.yubico.com/support/partners/#password-management https://www.yubico.com/support/partners/#password-management The touch setting is specific to OpenPGP keys. If you set it, it works that way for all uses of your OpenPGP key. You can turn it on to see if you like it. If you do, you can also set it to 'fix.' Once fixed, it can never be turned off again without deleting the private key and starting over. https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_touch https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_...
- irremediable 10y agoIn that setup, how do you handle needing passwords on your phone?
- Fnoord 10y agoWhich phone? If it is Android, you could root it and use the same commands. Else, if you don't want to root or are using iOS there is software available for LastPass and 1Password.
- danjoc 10y agoThere's an app for that. Android Password Store[1]. You can use a Yubikey Neo with NFC in combination with Open Keychain[2]. Both are available on F-Droid. [1]https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store [2]https://github.com/open-keychain/open-keychain https://github.com/open-keychain/open-keychain
- smartbit 10y agoIn the case you what to use the some passwords on iDevices, what would you recommend for password db? EDIT: irremediable posed the same question at the same time ;-)
- danjoc 10y agoiOS doesn't have an NFC API. Thanks Apple. https://www.yubico.com/products/yubikey-hardware/yubikey-neo/#toggle-id-8 https://www.yubico.com/products/yubikey-hardware/yubikey-neo... Works okay on Mac OS with GPGTools and QTPass.
- clarry 10y agoSo what happens when you lose the yubikey?
- danjoc 10y agoYou can encrypt a folder to multiple public keys. Good for having a backup yubikey, sharing a group of passwords with a spouse or other vip, etc.
- pwg 10y agoIf you have a trojan, then it does not matter what form of password storage you use (meat or manager). Any password you enter into the computer with the trojan is at risk of compromise.
- lqdc13 10y agoIf you have a keylogger malware, you only reveal the passwords you type in until you get rid of the malware. Also, you will likely notice something being off if you have malware before you type in every single one of your passwords. PW managers - especially those written by others and widely used - are the most attractive targets for an attacker.