3 ms·

I use my own hand-rolled password management system. Everyone told me: "don't roll your own password manager!!" Here's the thing: yes, my tool is probably less

I use my own hand-rolled password management system. Everyone told me: "don't roll your own password manager!!" Here's the thing: yes, my tool is probably less secure than a professional tool, by an order of magnitude. But it's also a far less attractive target for hackers. If you spend an hour to crack my tool, you get one guy's data. If you spend 1000 hours to crack LastPass, you get millions of users' data. The cost::payoff ratio for hacking LastPass is far better.

ltbarcly3 4y ago
Right, security advice is always given as though everyone will follow it and it has to work for really useless dummies that don't understand anything about it. They also say not to roll your own encryption, but if you encrypt your data and then use ssl it does increase security. When there is some bug meaning your ssh key was easily guessable (happened with dsa keys) having that obfuscation will prevent bulk collection from doing things like keyword matching against your data. Doesn't work if everyone does it, but it does work. Most of the time you gain the most not from state-level impossible to break security, because most of the time you aren't trying to defeat a room full of geniuses all working full time with you as a target.
- cma 4y ago
  On the other hand you see things like people xor'ing with the same random number stream twice, causing things to be encrypted to plaintext.
taylodl 4y ago
Not only that but there are security best practices you can follow when rolling your own that can keep your data reasonably secure. Enough so that the cost::payoff ratio is even worse and you're that much less likely to be hacked.
pmontra 4y ago
You can use one of the several password managers of the keepass family. They are local, you can share the encrypted password database with your other devices and maybe it has more features that one's own password manager. But by going DIY you probably learned more about passwords management than the average person.
running101 4y ago
I use keypassxc xc with the browser plug-in. Also have a very long master password on my yubikey which I long press to enter the master password. The I use one of the cloud drives to sync it. I never liked the idea of entering my passwords into a service like lastpass.

ltbarcly3 4y ago

Right, security advice is always given as though everyone will follow it and it has to work for really useless dummies that don't understand anything about it. They also say not to roll your own encryption, but if you encrypt your data and then use ssl it does increase security. When there is some bug meaning your ssh key was easily guessable (happened with dsa keys) having that obfuscation will prevent bulk collection from doing things like keyword matching against your data. Doesn't work if everyone does it, but it does work. Most of the time you gain the most not from state-level impossible to break security, because most of the time you aren't trying to defeat a room full of geniuses all working full time with you as a target.

cma 4y ago
On the other hand you see things like people xor'ing with the same random number stream twice, causing things to be encrypted to plaintext.

taylodl 4y ago

Not only that but there are security best practices you can follow when rolling your own that can keep your data reasonably secure. Enough so that the cost::payoff ratio is even worse and you're that much less likely to be hacked.

pmontra 4y ago

You can use one of the several password managers of the keepass family. They are local, you can share the encrypted password database with your other devices and maybe it has more features that one's own password manager. But by going DIY you probably learned more about passwords management than the average person.

running101 4y ago

I use keypassxc xc with the browser plug-in. Also have a very long master password on my yubikey which I long press to enter the master password. The I use one of the cloud drives to sync it. I never liked the idea of entering my passwords into a service like lastpass.