5 ms·

> They were already in widespread use in 2010. I'm interested in knowing the stats of this, but 1Password's first release was mid-2006. I know personally I sta

> They were already in widespread use in 2010. I'm interested in knowing the stats of this, but 1Password's first release was mid-2006. I know personally I started using 1Password in late 2008, 2009. But I'd argue even then that they were not "widespread" then and even now are not entirely widespread. (Unless you count Cloud Keychain). Arguably I think the more security conscious were using them, but even now, after several years, I STILL have to remind my wife about it and to put passwords in there.

mongol 3y ago
I remember a colleague telling me about this, he used one late 2007. I thought "what unneccessary complexity, I store them encrypted with vim, much better". I know better now.
- zlg_codes 3y ago
  What do you find better about a password manager compared to having total control and storing the passwords yourself in a simple text file? You still need a master password to access the information, and while there's less automation, there is a degree of simplicity and accessibility that is only paralleled by a built-in OS primitive for it. GPG and Vim are on just about everything. I would like to read write-ups of people who lost their password manager and were still able to use the encrypted storage and retrieve secrets with alternative tools. Being dependent on a specific tool for accessing dozens of sites feels like adding fragile infrastructure to my online identity. The only SPOF should be whether my body has access to an Internet connection! :) Granted, the quality of the encrypted text file is dependent on your discipline in managing it. However, it's simple and compatible with most *nix systems out of the box. Maybe part of it is how one interacts online, too? I try to reduce the number of accounts I have on the Web. Each one is another potential data leak risk. I might have different needs if I kept signing up to site after site, or needed to manage a brand or something else that's interaction- and account-heavy. Aside from my personal server, I probably have fewer than 10 or 12 passwords to remember or manage. If we add a zero, I see the use for a password manager.
  - mongol 3y ago
    I was naive about vims encryption. I did not realize that an encryption key is not the same as a password. It is much more feasible to brute force vim's encryption than to brute force a login for example. And if I am not mistaken the feature has been removed from vim now.
    - zlg_codes 3y ago
      Oh I see, is this part of Vim's built-in stuff? I had no idea Vim could do that, so I used the vim-gnupg plugin to call out to `gpg` on the command line. It's possible that the plain contents of the file are in RAM while the buffer is being worked on, but I haven't taken a look at memory layouts to see how easy it would be to extract a key or buffer contents.
      - mongol 3y ago
        Yes it was called vimcrypt or something like that. The difference compared with gpg is (among other things) that with vimcrypt you could use an arbitrarily short key, say 12 characters, like a password is long. That is much too short to be secure.
Zak 3y ago
The author is presumably among the more security conscious, which makes it even more surprising he didn't mention password managers even if only to dismiss them. https://en.wikipedia.org/wiki/John_Graham-Cumming https://en.wikipedia.org/wiki/John_Graham-Cumming
Izkata 3y ago
Even aside from external managers that existed at the time, Firefox already had its built-in password manager at least as far back as 2006.

mongol 3y ago

I remember a colleague telling me about this, he used one late 2007. I thought "what unneccessary complexity, I store them encrypted with vim, much better". I know better now.

zlg_codes 3y ago
What do you find better about a password manager compared to having total control and storing the passwords yourself in a simple text file? You still need a master password to access the information, and while there's less automation, there is a degree of simplicity and accessibility that is only paralleled by a built-in OS primitive for it. GPG and Vim are on just about everything. I would like to read write-ups of people who lost their password manager and were still able to use the encrypted storage and retrieve secrets with alternative tools. Being dependent on a specific tool for accessing dozens of sites feels like adding fragile infrastructure to my online identity. The only SPOF should be whether my body has access to an Internet connection! :) Granted, the quality of the encrypted text file is dependent on your discipline in managing it. However, it's simple and compatible with most *nix systems out of the box. Maybe part of it is how one interacts online, too? I try to reduce the number of accounts I have on the Web. Each one is another potential data leak risk. I might have different needs if I kept signing up to site after site, or needed to manage a brand or something else that's interaction- and account-heavy. Aside from my personal server, I probably have fewer than 10 or 12 passwords to remember or manage. If we add a zero, I see the use for a password manager.
- mongol 3y ago
  I was naive about vims encryption. I did not realize that an encryption key is not the same as a password. It is much more feasible to brute force vim's encryption than to brute force a login for example. And if I am not mistaken the feature has been removed from vim now.
  - zlg_codes 3y ago
    Oh I see, is this part of Vim's built-in stuff? I had no idea Vim could do that, so I used the vim-gnupg plugin to call out to `gpg` on the command line. It's possible that the plain contents of the file are in RAM while the buffer is being worked on, but I haven't taken a look at memory layouts to see how easy it would be to extract a key or buffer contents.
    - mongol 3y ago
      Yes it was called vimcrypt or something like that. The difference compared with gpg is (among other things) that with vimcrypt you could use an arbitrarily short key, say 12 characters, like a password is long. That is much too short to be secure.

Zak 3y ago

The author is presumably among the more security conscious, which makes it even more surprising he didn't mention password managers even if only to dismiss them. https://en.wikipedia.org/wiki/John_Graham-Cumming https://en.wikipedia.org/wiki/John_Graham-Cumming

Izkata 3y ago

Even aside from external managers that existed at the time, Firefox already had its built-in password manager at least as far back as 2006.