4 ms·

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to m

Confession: I store all my passwords in a plaintext file on my local desktop. I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension). Think about today's threat landscape and tell me I'm wrong. I may not be more secure in every possible situation, but I'm more secure in the situations that cause the vast majority of breaches today.

kalekold 5y ago
I do the same and encrypt the file with a simple encryption tool.
- civilized 5y ago
  Good idea. I wish I could be bothered to do this slightly more secure thing to protect my entire livelihood, lol... I'll think about it.
causality0 5y ago
Not that your approach doesn't have advantages, but at that point I would just keep them in a paper notebook hidden in my desk.
- civilized 5y ago
  I'm a lazy bastard.
- foxfluff 5y ago
  That's what I do. The number of times my home's been broken into: 0 (and based on news, virtually all of burglars are just looking for jewelry, wallets, and similar stuff and they won't bother trawling through your papers for passwords). The number of times I've had devices on my network that run some hastily put together vendor firmware that was last updated six years ago: too many to count. The number of times I've had to rush to update/patch my own computers to fix a newly disclosed remotely exploitable vuln: quite a few. The number of times I've actually witnessed attempts at trying to exploit said remote vulns: too many to count! Sometimes mere hours after I've patched my stuff. The number of times I've known I've had malware: at least a couple times (admittedly long ago, back when I ran Windows..). I just don't trust keeping personal passwords on online connected computing devices. And password managers are a very lucrative target today (plus it tends to be all eggs in one basket for most people!). I do keep passwords for employer's stuff in a password manager but not on the same device(s) I use said passwords on; even if you had malware on my work laptop, you wouldn't get my master password, nor would you be able to grab my password database. Passwords are also not stored on any third party service. The price I pay is a relatively minor inconvenience. (I do have plans for something more convenient though!)
onlyrealcuzzo 5y ago
You could just use KeePass: https://keepass.info/ https://keepass.info/ It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely. And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.
- sabhiram 5y ago
  Seems useful, the name gave me a chuckle. If I only saw the URL, I would imagine this was a service that providing info on preserving your buttocks.
  - civilized 5y ago
    It's fitting, good password management is the "watch out for your Cornhole" of the 21st century...
  - foxfluff 5y ago
    There's a service "keeping donkeys". You can adopt your own <3 https://www.thedonkeysanctuary.org.uk/adopt https://www.thedonkeysanctuary.org.uk/adopt
    - sysstemlord 5y ago
      Asley looks nice, I always wanted when I get a donkey to name it Ashley.
- asquabventured 5y ago
  Keepass is great. If you like to have synced database between devices with minimal risk of exposure I would recommend setting it up to use a master password AND generated key file. I do this, then sync my database to cloud/butt and just keep my key file offline and on device only. Edit: I believe you can also use a FIDO/U2F key (yubikey, google titan, etc.) in place of a key file but 2 password lock is great even if someone guesses your master password, the database is still useless without the 2nd key.
tarboreus 5y ago
I do this, though I encrypt with GPG and a password. When I open the file, Emacs prompts for the password. It's pretty convenient, honestly, and I use the same system for sensitive notes, etc.
Lanrei 5y ago
If you want to store you passwords locally, then at least use something like Keepass or KeepassXC. It's far from a perfect solution as it's still vulnerable to targeted attacks when it's being used if your computer is compromised. But at least they're not store in plain text. Also password auto-typing and generation are nice to have. You can sync the encrypted files to your phone or other computers.
- KennyBlanken 5y ago
  This is why newer versions of MacOS require you to grant permissions for an application to access folders in your user account. If you keep the keepass database in a folder like "secure", then no other program will be able to get to it. On Linux, there are a ton of ways of implementing something similar. KeepassXC requires authorizing a plugin, and authorizing specific sites before it releases a password.
dahart 5y ago
I see nothing wrong with using a plaintext file on your computer, that’s likely going to be safer than using a cloud based solution for a desktop computer that only you access, especially if you don’t have remote access. Important questions might be how secure is your computer (encrypted HD, multiple users, etc), what incoming services have you enabled (ssh?), does your computer ever travel (is it a laptop, is it prone to loss or theft), and how secure is your apartment/house (is a robbery plausible). The main thing a desktop file is, for most people who use password managers, is inconvenient. Without some kind of remote access at home, it might mean not having access to passwords when doing errands or traveling, any time when not physically at home. But with remote access, the password file access does become riskier, that does become cloud access where you’re responsible for the security of all methods of remote access (are any ports open you don’t know about?). Having my password manager on my phone has been incredibly useful at times.
- EVa5I7bHFq9mnYK 5y ago
  Yeah, if hackers got to your plain text file, they probably also installed a keylogger and clipboard scanner, in which case they have all your passwords, lastpass or not.
2OEH8eoCRo0 5y ago
Confession: I write them down. My threat model is 100% aimed at remote attacks/hackers. I could not care less about law enforcement. I also use a hardware backed second factor.
- CyberRage 5y ago
  That's still an issue. humanly generated passwords tend to be predictable, repetitive and not very long. A computer will always do a better job at generating\remembering passwords. hardware 2FA is definitely a good idea.
  - 2OEH8eoCRo0 5y ago
    They aren't human generated. I generate them programmatically and don't store them on silicon but on paper.
    - SV_BubbleTime 5y ago
      Secure paper is one of the best methods. The issue is when you want to access that paper remotely or on the go. Then it becomes a really bad method.
  - dgudkov 5y ago
    >humanly generated passwords tend to be predictable, repetitive and not very long. Not necessarily. See https://xkcd.com/936/ https://xkcd.com/936/
Kiro 5y ago
Confession: I use Chrome's built-in password manager.
Latty 5y ago
Inherently less secure than an extension that fills the passwords, as it relies on you checking the URL correctly, while an extension will only fill it when the origin is correct, which means you are less likely to be phished (although a security key is even better for that).
- civilized 5y ago
  Meh... you're just looking at one threat, and one that isn't remotely likely in my reckoning. I don't think I've ever been phished. It's very easy to spot.
  - Latty 5y ago
    The one that springs to mind was the one that changes the contents of the page while it's in the background to a google log in page—very sophisticated and not something most people were prepared to spot, as people think of following a link as the moment of vulnerability. Tons of people who are very aware and capable have been phished successfully. If you think it isn't likely, you are likely vulnerable. "Not very likely" is just obviously not true—phishing is a very common attack, and companies like Google have adopted security keys to protect against it.
amcsi 5y ago
I use Vim's built in symmetric encryption with :X One of the reasons I haven't moved over to NeoVim is because they removed this feature, because supposedly it's not perfect or something. So sure, the NSA may be able to still be able to extract my passwords if they arrest me and take my computer, but the point is that random people won't be able to.

kalekold 5y ago

I do the same and encrypt the file with a simple encryption tool.

civilized 5y ago
Good idea. I wish I could be bothered to do this slightly more secure thing to protect my entire livelihood, lol... I'll think about it.

causality0 5y ago

Not that your approach doesn't have advantages, but at that point I would just keep them in a paper notebook hidden in my desk.

civilized 5y ago
I'm a lazy bastard.
foxfluff 5y ago
That's what I do. The number of times my home's been broken into: 0 (and based on news, virtually all of burglars are just looking for jewelry, wallets, and similar stuff and they won't bother trawling through your papers for passwords). The number of times I've had devices on my network that run some hastily put together vendor firmware that was last updated six years ago: too many to count. The number of times I've had to rush to update/patch my own computers to fix a newly disclosed remotely exploitable vuln: quite a few. The number of times I've actually witnessed attempts at trying to exploit said remote vulns: too many to count! Sometimes mere hours after I've patched my stuff. The number of times I've known I've had malware: at least a couple times (admittedly long ago, back when I ran Windows..). I just don't trust keeping personal passwords on online connected computing devices. And password managers are a very lucrative target today (plus it tends to be all eggs in one basket for most people!). I do keep passwords for employer's stuff in a password manager but not on the same device(s) I use said passwords on; even if you had malware on my work laptop, you wouldn't get my master password, nor would you be able to grab my password database. Passwords are also not stored on any third party service. The price I pay is a relatively minor inconvenience. (I do have plans for something more convenient though!)

onlyrealcuzzo 5y ago

You could just use KeePass: https://keepass.info/ https://keepass.info/ It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely. And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

sabhiram 5y ago
Seems useful, the name gave me a chuckle. If I only saw the URL, I would imagine this was a service that providing info on preserving your buttocks.
- civilized 5y ago
  It's fitting, good password management is the "watch out for your Cornhole" of the 21st century...
- foxfluff 5y ago
  There's a service "keeping donkeys". You can adopt your own <3 https://www.thedonkeysanctuary.org.uk/adopt https://www.thedonkeysanctuary.org.uk/adopt
  - sysstemlord 5y ago
    Asley looks nice, I always wanted when I get a donkey to name it Ashley.
asquabventured 5y ago
Keepass is great. If you like to have synced database between devices with minimal risk of exposure I would recommend setting it up to use a master password AND generated key file. I do this, then sync my database to cloud/butt and just keep my key file offline and on device only. Edit: I believe you can also use a FIDO/U2F key (yubikey, google titan, etc.) in place of a key file but 2 password lock is great even if someone guesses your master password, the database is still useless without the 2nd key.

tarboreus 5y ago

I do this, though I encrypt with GPG and a password. When I open the file, Emacs prompts for the password. It's pretty convenient, honestly, and I use the same system for sensitive notes, etc.

Lanrei 5y ago

If you want to store you passwords locally, then at least use something like Keepass or KeepassXC. It's far from a perfect solution as it's still vulnerable to targeted attacks when it's being used if your computer is compromised. But at least they're not store in plain text. Also password auto-typing and generation are nice to have. You can sync the encrypted files to your phone or other computers.

KennyBlanken 5y ago
This is why newer versions of MacOS require you to grant permissions for an application to access folders in your user account. If you keep the keepass database in a folder like "secure", then no other program will be able to get to it. On Linux, there are a ton of ways of implementing something similar. KeepassXC requires authorizing a plugin, and authorizing specific sites before it releases a password.

dahart 5y ago

I see nothing wrong with using a plaintext file on your computer, that’s likely going to be safer than using a cloud based solution for a desktop computer that only you access, especially if you don’t have remote access. Important questions might be how secure is your computer (encrypted HD, multiple users, etc), what incoming services have you enabled (ssh?), does your computer ever travel (is it a laptop, is it prone to loss or theft), and how secure is your apartment/house (is a robbery plausible). The main thing a desktop file is, for most people who use password managers, is inconvenient. Without some kind of remote access at home, it might mean not having access to passwords when doing errands or traveling, any time when not physically at home. But with remote access, the password file access does become riskier, that does become cloud access where you’re responsible for the security of all methods of remote access (are any ports open you don’t know about?). Having my password manager on my phone has been incredibly useful at times.

EVa5I7bHFq9mnYK 5y ago
Yeah, if hackers got to your plain text file, they probably also installed a keylogger and clipboard scanner, in which case they have all your passwords, lastpass or not.

2OEH8eoCRo0 5y ago

Confession: I write them down. My threat model is 100% aimed at remote attacks/hackers. I could not care less about law enforcement. I also use a hardware backed second factor.

CyberRage 5y ago
That's still an issue. humanly generated passwords tend to be predictable, repetitive and not very long. A computer will always do a better job at generating\remembering passwords. hardware 2FA is definitely a good idea.
- 2OEH8eoCRo0 5y ago
  They aren't human generated. I generate them programmatically and don't store them on silicon but on paper.
  - SV_BubbleTime 5y ago
    Secure paper is one of the best methods. The issue is when you want to access that paper remotely or on the go. Then it becomes a really bad method.
- dgudkov 5y ago
  >humanly generated passwords tend to be predictable, repetitive and not very long. Not necessarily. See https://xkcd.com/936/ https://xkcd.com/936/

Kiro 5y ago

Confession: I use Chrome's built-in password manager.

Latty 5y ago

Inherently less secure than an extension that fills the passwords, as it relies on you checking the URL correctly, while an extension will only fill it when the origin is correct, which means you are less likely to be phished (although a security key is even better for that).

civilized 5y ago
Meh... you're just looking at one threat, and one that isn't remotely likely in my reckoning. I don't think I've ever been phished. It's very easy to spot.
- Latty 5y ago
  The one that springs to mind was the one that changes the contents of the page while it's in the background to a google log in page—very sophisticated and not something most people were prepared to spot, as people think of following a link as the moment of vulnerability. Tons of people who are very aware and capable have been phished successfully. If you think it isn't likely, you are likely vulnerable. "Not very likely" is just obviously not true—phishing is a very common attack, and companies like Google have adopted security keys to protect against it.

amcsi 5y ago

I use Vim's built in symmetric encryption with :X One of the reasons I haven't moved over to NeoVim is because they removed this feature, because supposedly it's not perfect or something. So sure, the NSA may be able to still be able to extract my passwords if they arrest me and take my computer, but the point is that random people won't be able to.