6 ms·

> Let's say you have good old traditional username and passwords on 50 different websites. That's 50 different programmers who all have different ideas of how y

> Let's say you have good old traditional username and passwords on 50 different websites. That's 50 different programmers who all have different ideas of how your password should be stored. I hope for your sake you used a different (and extremely secure) password on every single one of those websites. Because statistically speaking, you're screwed. A great reason to use a password manager, like LastPass. I started using it ~1 year ago, and now each of my web logins has a different password. It's just one key combo to generate a new random password and insert it into the password field when signing up at a new site.

ZoFreX 16y ago
Of course, you do now have to trust LastPass! I do, and it's fantastic the difference it makes in these situations. No sick feeling in your stomach, no rush to change passwords everywhere, a few clicks and the problem is solved. Extra credit: use their security challenge to verify you're not using the same password on more than one website: https://lastpass.com/?securitychallenge https://lastpass.com/?securitychallenge
- thalur 16y ago
  I've been looking at switching to a password manager like that, but I've been having trouble knowing how to pick one that a) I can trust and b) is good. I was thinking of giving up and just using a plain text file inside a truecrypt file.
  - stcredzero 16y ago
    KeePass. Using KeePass 1 format means I can run my password crypt on Windows, OS X, and Linux. I just keep the database file on Dropbox.
    - ZoFreX 16y ago
      A lot of people seem to do this, so I'm curious - what are the advantages compared to e.g. LastPass? Also, how well does it hold up if you used two devices simultaneously?
      - stcredzero 16y ago
        KeePass writes out a lock file, so the other instances will warn you and you can tell them to open the database as read-only. Advantages? I guess I should try out LastPass. Free or $1/month premium is a good price.
        ZoFreX 16y ago
        Cool. I always saw this as a limitation but honestly it's very, very rare that I need simultaneous write - just simultaneous read. I will start recommending KeePass + Dropbox to those who don't trust LastPass. What's KeePass's browser integration like?
  - ZoFreX 16y ago
    I can't really help you with a, that's largely dependent on you. Whether it meets requirement b depends on how you're going to be using it, really. My use case is mostly websites, in Firefox and Chrome, and occasionally on my Android phone. I wanted the UI to integrate nicely with the browser, to be able to store other passwords besides, for the architecture to be secure (passwords are always encrypted with your master password before going to their servers, and your password is never transmitted to them), for it to have two-factor authentication, to sync automatically, and for it to have a website backup for access without the extension. LastPass fit all these, but it might not fit your usage requirements. However, I would urge you to investigate it and all other options (KeePass seems popular, as are some other Firefox extensions) if you don't currently have a good password solution, as any of these is better than using the same password multiple places.
- run4yourlives 16y ago
  >Of course, you do now have to trust LastPass! PassPack doesn't have this issue. Even they can't read your passwords.
  - w1ntermute 16y ago
    Neither can LastPass. All your data is encrypted before it's sent to their servers. It's only decrypted client-side.
    - ZoFreX 16y ago
      Right, but you have to take their word for that (not exclusive to LastPass, goes for any service like this). So ultimately, you still have to trust them.
yason 16y ago
I just use GPG and Emacs: - I have a text file encrypted with GPG that contains my list of passwords. - I open it in Emacs like any normal file. - GPG is integrated to Gnome so I get a nice askpass dialog even from inside Emacs. - I've configured Gnome to store the decrypted key for a few hours (or until suspend) and ask me anytime the cached passphrase will be reused, to avoid typing my long passphrase everytime I need to look up a password. - Emacs also knows how to encrypt the file transparently when I've made changes and just save the buffer in Emacs. - My swap partition is encrypted via TrueCrypt and so is my /home.

ZoFreX 16y ago

Of course, you do now have to trust LastPass! I do, and it's fantastic the difference it makes in these situations. No sick feeling in your stomach, no rush to change passwords everywhere, a few clicks and the problem is solved. Extra credit: use their security challenge to verify you're not using the same password on more than one website: https://lastpass.com/?securitychallenge https://lastpass.com/?securitychallenge

thalur 16y ago
I've been looking at switching to a password manager like that, but I've been having trouble knowing how to pick one that a) I can trust and b) is good. I was thinking of giving up and just using a plain text file inside a truecrypt file.
- stcredzero 16y ago
  KeePass. Using KeePass 1 format means I can run my password crypt on Windows, OS X, and Linux. I just keep the database file on Dropbox.
  - ZoFreX 16y ago
    A lot of people seem to do this, so I'm curious - what are the advantages compared to e.g. LastPass? Also, how well does it hold up if you used two devices simultaneously?
    - stcredzero 16y ago
      KeePass writes out a lock file, so the other instances will warn you and you can tell them to open the database as read-only. Advantages? I guess I should try out LastPass. Free or $1/month premium is a good price.
      - ZoFreX 16y ago
        Cool. I always saw this as a limitation but honestly it's very, very rare that I need simultaneous write - just simultaneous read. I will start recommending KeePass + Dropbox to those who don't trust LastPass. What's KeePass's browser integration like?
- ZoFreX 16y ago
  I can't really help you with a, that's largely dependent on you. Whether it meets requirement b depends on how you're going to be using it, really. My use case is mostly websites, in Firefox and Chrome, and occasionally on my Android phone. I wanted the UI to integrate nicely with the browser, to be able to store other passwords besides, for the architecture to be secure (passwords are always encrypted with your master password before going to their servers, and your password is never transmitted to them), for it to have two-factor authentication, to sync automatically, and for it to have a website backup for access without the extension. LastPass fit all these, but it might not fit your usage requirements. However, I would urge you to investigate it and all other options (KeePass seems popular, as are some other Firefox extensions) if you don't currently have a good password solution, as any of these is better than using the same password multiple places.
run4yourlives 16y ago
>Of course, you do now have to trust LastPass! PassPack doesn't have this issue. Even they can't read your passwords.
- w1ntermute 16y ago
  Neither can LastPass. All your data is encrypted before it's sent to their servers. It's only decrypted client-side.
  - ZoFreX 16y ago
    Right, but you have to take their word for that (not exclusive to LastPass, goes for any service like this). So ultimately, you still have to trust them.

yason 16y ago

I just use GPG and Emacs: - I have a text file encrypted with GPG that contains my list of passwords. - I open it in Emacs like any normal file. - GPG is integrated to Gnome so I get a nice askpass dialog even from inside Emacs. - I've configured Gnome to store the decrypted key for a few hours (or until suspend) and ask me anytime the cached passphrase will be reused, to avoid typing my long passphrase everytime I need to look up a password. - Emacs also knows how to encrypt the file transparently when I've made changes and just save the buffer in Emacs. - My swap partition is encrypted via TrueCrypt and so is my /home.