4 ms·

As someone who has been through probably every popular password manager at this point, make sure to decide what you might need in the future. Honestly, it real

As someone who has been through probably every popular password manager at this point, make sure to decide what you might need in the future. Honestly, it really boils down to "Do you want to use Linux and not have a half broken client running in Wine". Either way, 1Password is nice :) I use KeepassXC myself which I can recommend.

bhhaskin 9y ago
Should check on password-store. Uses gpg encryption and git for syncing. Can't recommend it enough!
- eadmund 9y ago
  Bear in mind, though, that password-store doesn't encrypt its filenames, so you should only use it with git-remote-gcrypt or similar (which isn't currently supported by any password-store mobile app, so you can't use it on your phone). Leaving filenames unencrypted means that anyone who can view your encrypted data (e.g. GitHub, GitLab, your local admin — whomever) knows which sites you frequent & care to protect.
scrollaway 9y ago
Seconding KeepassXC recommendation. Here's an intro to it, and to password managers in general: https://leclan.ch/password-managers/ https://leclan.ch/password-managers/ PS: KeepassXC has an open issue to work on integrating itself as the system keyring (eg. providing the system keyring). If anyone is interested in working on it, check out https://github.com/keepassxreboot/keepassxc/issues/1403 https://github.com/keepassxreboot/keepassxc/issues/1403 !
- muxator 9y ago
  I fear to know the answer already, but let me ask anyway: does exist any strong password manager that is integrated with Firefox sync?
  - scrollaway 9y ago
    KeepassXC has a browser integration, so it integrates with Firefox, but not with Firefox Sync which only cares about the stuff it stores itself.
  - eadmund 9y ago
    Firefox Sync is insecure and should not be used. This didn't used to be the case — it used to be world-class — but the engineers decided to utterly destroy its security. All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Worse, they use dynamically-downloaded JavaScript to handle your password, which means even if you use a high-entropy passphrase Mozilla can at any time send you malicious JavaScript and snarf your passphrase. This means that any government Mozilla must obey can do the same thing. Mozilla Accounts are thus fundamentally insecure and must not be used. It breaks my heart: they went from having the world's best password-sync security to having its worst. Even Google's system is quite so blatantly security-hostile. When your concern for your users is less than Google's, you really are doing something wrong.
    - staticassertion 9y ago
      > All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? It makes it sound like they aren't key stretching, which seems unlikely. Can you provide a source here? > Worse, they use dynamically-downloaded JavaScript to handle your password, which means even if you use a high-entropy passphrase Mozilla can at any time send you malicious JavaScript and snarf your passphrase. I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system. > This means that any government Mozilla must obey can do the same thing. I'm not sure this is true, mostly because it lacks any sort of precedent.
      - eadmund 9y ago

bhhaskin 9y ago

Should check on password-store. Uses gpg encryption and git for syncing. Can't recommend it enough!

eadmund 9y ago
Bear in mind, though, that password-store doesn't encrypt its filenames, so you should only use it with git-remote-gcrypt or similar (which isn't currently supported by any password-store mobile app, so you can't use it on your phone). Leaving filenames unencrypted means that anyone who can view your encrypted data (e.g. GitHub, GitLab, your local admin — whomever) knows which sites you frequent & care to protect.

scrollaway 9y ago

Seconding KeepassXC recommendation. Here's an intro to it, and to password managers in general: https://leclan.ch/password-managers/ https://leclan.ch/password-managers/ PS: KeepassXC has an open issue to work on integrating itself as the system keyring (eg. providing the system keyring). If anyone is interested in working on it, check out https://github.com/keepassxreboot/keepassxc/issues/1403 https://github.com/keepassxreboot/keepassxc/issues/1403 !

muxator 9y ago
I fear to know the answer already, but let me ask anyway: does exist any strong password manager that is integrated with Firefox sync?
- scrollaway 9y ago
  KeepassXC has a browser integration, so it integrates with Firefox, but not with Firefox Sync which only cares about the stuff it stores itself.
- eadmund 9y ago
  Firefox Sync is insecure and should not be used. This didn't used to be the case — it used to be world-class — but the engineers decided to utterly destroy its security. All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Worse, they use dynamically-downloaded JavaScript to handle your password, which means even if you use a high-entropy passphrase Mozilla can at any time send you malicious JavaScript and snarf your passphrase. This means that any government Mozilla must obey can do the same thing. Mozilla Accounts are thus fundamentally insecure and must not be used. It breaks my heart: they went from having the world's best password-sync security to having its worst. Even Google's system is quite so blatantly security-hostile. When your concern for your users is less than Google's, you really are doing something wrong.
  - staticassertion 9y ago
    > All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? It makes it sound like they aren't key stretching, which seems unlikely. Can you provide a source here? > Worse, they use dynamically-downloaded JavaScript to handle your password, which means even if you use a high-entropy passphrase Mozilla can at any time send you malicious JavaScript and snarf your passphrase. I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system. > This means that any government Mozilla must obey can do the same thing. I'm not sure this is true, mostly because it lacks any sort of precedent.
    - eadmund 9y ago