3 ms·

In my opinion, storing passwords in encrypted files is probably safer than putting passwords in a centralized location (provided you don't code your own encrypt

In my opinion, storing passwords in encrypted files is probably safer than putting passwords in a centralized location (provided you don't code your own encryption algo or make other silly mistakes). There is not a lot of value in trying to attack a single person's password file, but the value is multiplied by the number of users when using a centralized platform.

jonny_eh 5y ago
> storing passwords in encrypted files is probably safer That is too hard or tedious for most people. Syncing is a pain, and doesn't autofill on websites or in apps.
agotterer 5y ago
I use https://git-secret.io https://git-secret.io for this. But it's not user friendly enough to be used for everyday web browsing and account access. I personally use it to store things like root passwords or reset tokens, which I very rarely access.
torstenvl 5y ago
> storing passwords in encrypted files Which you almost certainly access with some kind of software, yes? A password manager is just a piece of software that stores passwords in encrypted files, and makes it more convenient to edit them, associate them with a website, use them to log in, check them against known breaches, etc.
- antoineMoPa 5y ago
  I think local open source password management software that you run on your machine are more trustable and less likely to be the subject of a big targeted attack than a cloud tool. So just to be clear, I am not advocating against Keepass or similar, only web tools with thousands of users.
  - torstenvl 5y ago
    Fair. I moved from 1Password to Enpass when the former started pushing cloud big time. Enpass isn't open source but it's open... implementation details? There isn't a formal spec or standard but they were very forthcoming about how their encrypted SQLite implementation works and there are now open source third-party CLIs for it. https://github.com/hazcod/enpass-cli https://github.com/hazcod/enpass-cli
dividedbyzero 5y ago
One feature of 1Password (and other password managers with browser integration) that has saved me at least twice by now: The browser extensions will autofill only for matching domains. If autofill doesn't work on a site I have credentials in 1Password for, chances are it's a phishing attack. That's a last line of defence against well-crafted phishing attacks that I wouldn't want to give up.

jonny_eh 5y ago

> storing passwords in encrypted files is probably safer That is too hard or tedious for most people. Syncing is a pain, and doesn't autofill on websites or in apps.

agotterer 5y ago

I use https://git-secret.io https://git-secret.io for this. But it's not user friendly enough to be used for everyday web browsing and account access. I personally use it to store things like root passwords or reset tokens, which I very rarely access.

torstenvl 5y ago

> storing passwords in encrypted files Which you almost certainly access with some kind of software, yes? A password manager is just a piece of software that stores passwords in encrypted files, and makes it more convenient to edit them, associate them with a website, use them to log in, check them against known breaches, etc.

antoineMoPa 5y ago
I think local open source password management software that you run on your machine are more trustable and less likely to be the subject of a big targeted attack than a cloud tool. So just to be clear, I am not advocating against Keepass or similar, only web tools with thousands of users.
- torstenvl 5y ago
  Fair. I moved from 1Password to Enpass when the former started pushing cloud big time. Enpass isn't open source but it's open... implementation details? There isn't a formal spec or standard but they were very forthcoming about how their encrypted SQLite implementation works and there are now open source third-party CLIs for it. https://github.com/hazcod/enpass-cli https://github.com/hazcod/enpass-cli

dividedbyzero 5y ago

One feature of 1Password (and other password managers with browser integration) that has saved me at least twice by now: The browser extensions will autofill only for matching domains. If autofill doesn't work on a site I have credentials in 1Password for, chances are it's a phishing attack. That's a last line of defence against well-crafted phishing attacks that I wouldn't want to give up.