3 ms·

The only thing I had a hard time understanding- OP really cares about his privacy/security/password, but then he uses a secondary system to store it? Is this

The only thing I had a hard time understanding- OP really cares about his privacy/security/password, but then he uses a secondary system to store it? Is this the best way to do this? Break into the secondary system and everything is available. Keyloggers, eyes, stolen computers, all have the possibility of everything available. I considered other solutions like written + put in a lock box in a bank, but thats really inaccessable.

rjacksonm1 8y ago
It is the best way to do it for the average user. Modern password management services are incredibly secure, with client-side encryption of your secrets, among other protective mechanisms (to guard against keyloggers, stolen computers, ...) There is still a risk, because you're trusting third-party software (which in some cases is closed-source – including 1Password), but for most people that is a much lower risk profile than if they were managing passwords themselves. For specifics on 1password's security, check out https://1password.com/security/ https://1password.com/security/
- willvarfar 8y ago
  > Modern password management services are incredibly secure There lots of password managers that have had gaping vulnerabilities. From memory I'm sure I've seen LastPass vulnerabilities top HN just a while ago... yeah probably this one: https://www.bankinfosecurity.com/lastpass-patches-password-manager-vulnerability-a-9299 https://www.bankinfosecurity.com/lastpass-patches-password-m...
SCdF 8y ago
It does sound a bit silly, but the alternative is to keep them in your brain, and AFAICT it's impossible to do that these days. I have hundreds of accounts in my password manager, I couldn't possibly remember secure passwords for all of them. FWIW I'm not a fan of keeping them in some cloud service dedicated for storing passwords (1PW's subscription offering, lastpass) because if someone is going to break into servers and steal passwords it's going to be from those fine people. A middle ground is to use something like KeePass, where the encrypted password file is stored where you want it to be stored (ie your hard drive), where you can manage how you want to distribute that file between places you need it.
- jermaustin1 8y ago
  I use PasswordSafe which is open source, and I have it backed up to my dropbox (so my phone can access it). It is less convenient than most of the password managers out there having browser plugins that will automatically fill in your password, or generate one right in the text box, but the data is mine. I still have to rely on the mobile app which isn't open source, but it is the recommended app from the main developer.
kemitche 8y ago
A keylogger is pretty much game over regardless of your password strategy. Your passwords can be fully offline but you still need to enter your bank password on a connected device. On the security spectrum, for the vast majority of people, a password manager is a step up in how safe their passwords are.

rjacksonm1 8y ago

It is the best way to do it for the average user. Modern password management services are incredibly secure, with client-side encryption of your secrets, among other protective mechanisms (to guard against keyloggers, stolen computers, ...) There is still a risk, because you're trusting third-party software (which in some cases is closed-source – including 1Password), but for most people that is a much lower risk profile than if they were managing passwords themselves. For specifics on 1password's security, check out https://1password.com/security/ https://1password.com/security/

willvarfar 8y ago
> Modern password management services are incredibly secure There lots of password managers that have had gaping vulnerabilities. From memory I'm sure I've seen LastPass vulnerabilities top HN just a while ago... yeah probably this one: https://www.bankinfosecurity.com/lastpass-patches-password-manager-vulnerability-a-9299 https://www.bankinfosecurity.com/lastpass-patches-password-m...

SCdF 8y ago

It does sound a bit silly, but the alternative is to keep them in your brain, and AFAICT it's impossible to do that these days. I have hundreds of accounts in my password manager, I couldn't possibly remember secure passwords for all of them. FWIW I'm not a fan of keeping them in some cloud service dedicated for storing passwords (1PW's subscription offering, lastpass) because if someone is going to break into servers and steal passwords it's going to be from those fine people. A middle ground is to use something like KeePass, where the encrypted password file is stored where you want it to be stored (ie your hard drive), where you can manage how you want to distribute that file between places you need it.

jermaustin1 8y ago
I use PasswordSafe which is open source, and I have it backed up to my dropbox (so my phone can access it). It is less convenient than most of the password managers out there having browser plugins that will automatically fill in your password, or generate one right in the text box, but the data is mine. I still have to rely on the mobile app which isn't open source, but it is the recommended app from the main developer.

kemitche 8y ago

A keylogger is pretty much game over regardless of your password strategy. Your passwords can be fully offline but you still need to enter your bank password on a connected device. On the security spectrum, for the vast majority of people, a password manager is a step up in how safe their passwords are.