6 ms·

Using single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass,

Using single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass, Bitwarden etc). Reason is that you can use e.g. YubiKey to unlock individual entries on touch, this means that you can't lose whole password database on ransomware attack, (unless the ransomware has been there for a very long time). Filippo Valsorda wrote about this: https://blog.filippo.io/touch-to-operate-password-store-yubikey-4/ https://blog.filippo.io/touch-to-operate-password-store-yubi...

invokestatic 5y ago
This is still susceptible to ransomware. Ransomware will simply encrypt over each file with its own key, regardless of if the file is already encrypted or not.
- Ciantic 5y ago
  Backups is of course required. I was talking about Ransomware which also enters your password database and steals the passwords in order to do more harm. With YubiKey you can make the GPG private key on offline machine and upload it to YubiKey. This way you can always have a offline backup of your private key, and thus you can backup your password database too.
  - invokestatic 5y ago
    The term “ransomware” is never used to describe malware that steals passwords, thats the point of confusion.
Xylakant 5y ago
It also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.
- jehteh 5y ago
  If you are using GPG keys and have the master key backed up somewhere you can fairly easily use that on an offline machine to add the new key to the full batch of password files without needing to perform a million button presses.
  - doubled112 5y ago
    Been there and done that. People are backing up those keys, right? Could also disable the touch to decrypt feature while you performed the rekey?
    - jehteh 5y ago
      I hope people back up their GPG keys (and test their backups! My subkeys on the yubikey expire annually, forcing me to validate my master key backup at least once a year). Disabling touch is another option if you need to do a large batch of operations and are comfortable that your machine is secure.
    - kenmacd 5y ago
      You probably shouldn't be able to disable touch. If you can disable it then malware can disable it. I'd highly recommend using the `fix` option instead of `on` to make sure it can't be disabled.
  - captn3m0 5y ago
    Yup. My backup key (the one that doesn’t travel with me) doesn’t have the touch policy and I use that for any bulk operations.
- taeric 5y ago
  I'm not sure I follow. Adding a secret is done with your public key, so no need to even touch the yubikey to do that. And the idea is each one is a separate file. So, adding does not impact any other file. Edit: oh. Adding a new key, not password. I see how I misread.
- INTPenis 5y ago
hiptobecubic 5y ago
If you entire encrypted life is stored on a single computer with no backups you really should not be worried about ransomware and start worrying about things that will actually happen, like having your laptop stolen, or accidentally deleting something, or needing to replace your storage device.

invokestatic 5y ago

This is still susceptible to ransomware. Ransomware will simply encrypt over each file with its own key, regardless of if the file is already encrypted or not.

Ciantic 5y ago
Backups is of course required. I was talking about Ransomware which also enters your password database and steals the passwords in order to do more harm. With YubiKey you can make the GPG private key on offline machine and upload it to YubiKey. This way you can always have a offline backup of your private key, and thus you can backup your password database too.
- invokestatic 5y ago
  The term “ransomware” is never used to describe malware that steals passwords, thats the point of confusion.

Xylakant 5y ago

It also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.

jehteh 5y ago
If you are using GPG keys and have the master key backed up somewhere you can fairly easily use that on an offline machine to add the new key to the full batch of password files without needing to perform a million button presses.
- doubled112 5y ago
  Been there and done that. People are backing up those keys, right? Could also disable the touch to decrypt feature while you performed the rekey?
  - jehteh 5y ago
    I hope people back up their GPG keys (and test their backups! My subkeys on the yubikey expire annually, forcing me to validate my master key backup at least once a year). Disabling touch is another option if you need to do a large batch of operations and are comfortable that your machine is secure.
  - kenmacd 5y ago
    You probably shouldn't be able to disable touch. If you can disable it then malware can disable it. I'd highly recommend using the `fix` option instead of `on` to make sure it can't be disabled.
- captn3m0 5y ago
  Yup. My backup key (the one that doesn’t travel with me) doesn’t have the touch policy and I use that for any bulk operations.
taeric 5y ago
I'm not sure I follow. Adding a secret is done with your public key, so no need to even touch the yubikey to do that. And the idea is each one is a separate file. So, adding does not impact any other file. Edit: oh. Adding a new key, not password. I see how I misread.
INTPenis 5y ago

hiptobecubic 5y ago

If you entire encrypted life is stored on a single computer with no backups you really should not be worried about ransomware and start worrying about things that will actually happen, like having your laptop stolen, or accidentally deleting something, or needing to replace your storage device.