3 ms·
> Maybe I’ll use a different password manager I do that. I use pass <https://www.passwordstore.org/ https://www.passwordstore.org/> to store and get my BitWar
by tlamponi 4y ago
> Maybe I’ll use a different password manager
I do that.
I use pass <https://www.passwordstore.org/ https://www.passwordstore.org/> to store and get my BitWarden master PW. Pass is encrypted by a PGP key residing on my HW token/smart card and encrypted with a good but (for me) memorable PW.
In my case it's not really due to paranoia, but as I already had pass in use for critical and very important credentials before, and as I 1) was only evaluating BitWarden first and 2) did not want to remember two master passwords, so I went for this approach, and it works out quite well for how I use BitWarden (basically only on my workstation where I require my HW token anyway).
- iLoveOncall 4y agoI'm always surprised that people disclose so easily their whole security pipeline on HN, especially when their account has their real information.
- tlamponi 4y agoYeah, a developer owning a YubiKey and using a password manager, that's really revealing... Unless you're in for the criminal acts (and their repercussion), i.e., stealing my token and my keys to wherever my workstation stands and then torturing out both, my workstations and key's PW from my mind, it won't really help you... Or what did I really reveal with what actual real world implication that can compromise the security of (which?) systems I can access? IMO, if your "security pipeline" can be compromised due to documenting it (not the credentials used to access it!), even publicly, it wasn't that good of a "security pipeline" in the first place.