15 ms·

Is there a good “secrets manager” or “encrypted information manager” that’s free (preferably also open source) or quite cheap (not subscription based), is multi

Is there a good “secrets manager” or “encrypted information manager” that’s free (preferably also open source) or quite cheap (not subscription based), is multi-platform (including mobile) and supports auto-fill in other applications (especially browsers)? Password managers with password generators and 2FA code generators are ok for work related use, but they usually may not cover other pieces of information, like credit/debit cards, software licenses, identification cards, hardware/appliances, etc. Adding custom fields in each entry by oneself isn’t a great option. Perhaps it’s not a great idea (even with a very strong master password) to put all the information in one database, but I see value in being able to store, retrieve and auto fill different kinds of information (even if some may seem too complex to define in a generic schema). I already tried Bitwarden, but it covers only passwords, cards and identities (plus secure notes).

upofadown 7y ago
Boring old Unix Pass? * https://www.passwordstore.org/ https://www.passwordstore.org/ It's just a bunch of gpg encrypted files with as much stuff as you want in them, in any format you want (password on first line). Easy to share/sync to whatever you want. Lots of interfaces on lots of platforms but you really don't need an interface. Has git support...
- iudqnolq 7y ago
  Highschool me fucked up pass and exposed a lot of data. It was entirety my own fault, but there are footguns if you don't fully understand the model. Essentially, I accidentally publicly exposed my private key. I thought I was clever for writing a Python script to dump all my passwords and then re-add them after setting up pass with a new key. A year later, when I accidentally deleted my private key (reformatted laptop, phone bricked before set laptop back up), I spent a few hours trying to figure out if I made a mistake that would let me recover my passwords. I was very motivated :) Eventually, I realized that since I'd been using git to sync pass between my phone and computer (the recommended setup) I could access versions of my encrypted data for every account more than a year old and decrypt them with the private key I leaked. I got back almost all my data. Luckily I was using a private git repository for defense in depth, but many guides recommend a public reposity because they say gpg is very strong. It all works, but only if you don't do something dumb like I did. Now I'm on 1password and happy knowing that experienced people are paid to make it and smart security researchers like Troy Hunt (of haveibeenpwned fame) have said it's the most secure password manager they've looked into. (I said the same thing earlier in a different post)
  - upofadown 7y ago
    I take it that you had no passphrase on your private key?
    - iudqnolq 7y ago
      I did, but I presumed that I should still change the key once it was exposed. IIRC it was a nonrandom long passphrase (the first letter of every word in a 20-30 word sentence, I think. I've since moved to memorizing random passphrases). I was able to remember that password when I needed to recover the data later.
joelthelion 7y ago
Firefox Lockwise? Not sure if it supports all of your use cases though.
rv-de 7y ago
password safe (pwsafe.org) - I just use the "notes" text input.
BillinghamJ 7y ago
I don't really understand why Keybase hasn't pushed into this area. It seems like an obvious addition along with their other team services and new tools like git
owaislone 7y ago
I've been using CryFS with Google Drive for any kind of sensitive information and it has worked wonderfully well so far. I mostly store sensitive documents, encryption keys, 2FA setup and reset codes in there. A password manager could easily be built on top of it.
projektfu 7y ago
LastPass is free for single users. It’s good at holding secure notes and cards. It appears to encrypt everything client side. Not open source. Emacs is good at automatically keeping gpg files. Not sure about mobile support.
- projektfu 7y ago
  Also apparently one of these tools has a lot of detractors. Who knew?
vbezhenar 7y ago
Try KeePass. There's .NET implementation for Windows, there're few cross-platform C++ implementations for Linux and macOS, there are integrations with browser, there are mobile clients and you can configure sync as you like. For example I'm using KeePass on Windows desktop, synchronize it to my WebDAV server and then synchronize it with KeePassium iOS app. It works well and I control every single bit of it (I don't use browser extension because I think that it's too dangerous to let all my passwords to be accessible by something running in browser, but it's possible if you don't care). Simpler option for synchronization is dropbox which is popular among many users and works just as well.
vivekf 7y ago
Take a look at hashicorp's vault
avel 7y ago
I use Enpass. I believe it ticks all your boxes.

upofadown 7y ago

Boring old Unix Pass? * https://www.passwordstore.org/ https://www.passwordstore.org/ It's just a bunch of gpg encrypted files with as much stuff as you want in them, in any format you want (password on first line). Easy to share/sync to whatever you want. Lots of interfaces on lots of platforms but you really don't need an interface. Has git support...

iudqnolq 7y ago
Highschool me fucked up pass and exposed a lot of data. It was entirety my own fault, but there are footguns if you don't fully understand the model. Essentially, I accidentally publicly exposed my private key. I thought I was clever for writing a Python script to dump all my passwords and then re-add them after setting up pass with a new key. A year later, when I accidentally deleted my private key (reformatted laptop, phone bricked before set laptop back up), I spent a few hours trying to figure out if I made a mistake that would let me recover my passwords. I was very motivated :) Eventually, I realized that since I'd been using git to sync pass between my phone and computer (the recommended setup) I could access versions of my encrypted data for every account more than a year old and decrypt them with the private key I leaked. I got back almost all my data. Luckily I was using a private git repository for defense in depth, but many guides recommend a public reposity because they say gpg is very strong. It all works, but only if you don't do something dumb like I did. Now I'm on 1password and happy knowing that experienced people are paid to make it and smart security researchers like Troy Hunt (of haveibeenpwned fame) have said it's the most secure password manager they've looked into. (I said the same thing earlier in a different post)
- upofadown 7y ago
  I take it that you had no passphrase on your private key?
  - iudqnolq 7y ago
    I did, but I presumed that I should still change the key once it was exposed. IIRC it was a nonrandom long passphrase (the first letter of every word in a 20-30 word sentence, I think. I've since moved to memorizing random passphrases). I was able to remember that password when I needed to recover the data later.

joelthelion 7y ago

Firefox Lockwise? Not sure if it supports all of your use cases though.

rv-de 7y ago

password safe (pwsafe.org) - I just use the "notes" text input.

BillinghamJ 7y ago

I don't really understand why Keybase hasn't pushed into this area. It seems like an obvious addition along with their other team services and new tools like git

owaislone 7y ago

I've been using CryFS with Google Drive for any kind of sensitive information and it has worked wonderfully well so far. I mostly store sensitive documents, encryption keys, 2FA setup and reset codes in there. A password manager could easily be built on top of it.

projektfu 7y ago

LastPass is free for single users. It’s good at holding secure notes and cards. It appears to encrypt everything client side. Not open source. Emacs is good at automatically keeping gpg files. Not sure about mobile support.

projektfu 7y ago
Also apparently one of these tools has a lot of detractors. Who knew?

vbezhenar 7y ago

Try KeePass. There's .NET implementation for Windows, there're few cross-platform C++ implementations for Linux and macOS, there are integrations with browser, there are mobile clients and you can configure sync as you like. For example I'm using KeePass on Windows desktop, synchronize it to my WebDAV server and then synchronize it with KeePassium iOS app. It works well and I control every single bit of it (I don't use browser extension because I think that it's too dangerous to let all my passwords to be accessible by something running in browser, but it's possible if you don't care). Simpler option for synchronization is dropbox which is popular among many users and works just as well.

vivekf 7y ago

Take a look at hashicorp's vault

avel 7y ago

I use Enpass. I believe it ticks all your boxes.