3 ms·

I remember a colleague telling me about this, he used one late 2007. I thought "what unneccessary complexity, I store them encrypted with vim, much better". I k

by mongol 3y ago

I remember a colleague telling me about this, he used one late 2007. I thought "what unneccessary complexity, I store them encrypted with vim, much better". I know better now.

zlg_codes 3y ago
What do you find better about a password manager compared to having total control and storing the passwords yourself in a simple text file? You still need a master password to access the information, and while there's less automation, there is a degree of simplicity and accessibility that is only paralleled by a built-in OS primitive for it. GPG and Vim are on just about everything. I would like to read write-ups of people who lost their password manager and were still able to use the encrypted storage and retrieve secrets with alternative tools. Being dependent on a specific tool for accessing dozens of sites feels like adding fragile infrastructure to my online identity. The only SPOF should be whether my body has access to an Internet connection! :) Granted, the quality of the encrypted text file is dependent on your discipline in managing it. However, it's simple and compatible with most *nix systems out of the box. Maybe part of it is how one interacts online, too? I try to reduce the number of accounts I have on the Web. Each one is another potential data leak risk. I might have different needs if I kept signing up to site after site, or needed to manage a brand or something else that's interaction- and account-heavy. Aside from my personal server, I probably have fewer than 10 or 12 passwords to remember or manage. If we add a zero, I see the use for a password manager.
- mongol 3y ago
  I was naive about vims encryption. I did not realize that an encryption key is not the same as a password. It is much more feasible to brute force vim's encryption than to brute force a login for example. And if I am not mistaken the feature has been removed from vim now.
  - zlg_codes 3y ago
    Oh I see, is this part of Vim's built-in stuff? I had no idea Vim could do that, so I used the vim-gnupg plugin to call out to `gpg` on the command line. It's possible that the plain contents of the file are in RAM while the buffer is being worked on, but I haven't taken a look at memory layouts to see how easy it would be to extract a key or buffer contents.
    - mongol 3y ago
      Yes it was called vimcrypt or something like that. The difference compared with gpg is (among other things) that with vimcrypt you could use an arbitrarily short key, say 12 characters, like a password is long. That is much too short to be secure.

by mongol 3y ago

I remember a colleague telling me about this, he used one late 2007. I thought "what unneccessary complexity, I store them encrypted with vim, much better". I know better now.

zlg_codes 3y ago

What do you find better about a password manager compared to having total control and storing the passwords yourself in a simple text file? You still need a master password to access the information, and while there's less automation, there is a degree of simplicity and accessibility that is only paralleled by a built-in OS primitive for it. GPG and Vim are on just about everything. I would like to read write-ups of people who lost their password manager and were still able to use the encrypted storage and retrieve secrets with alternative tools. Being dependent on a specific tool for accessing dozens of sites feels like adding fragile infrastructure to my online identity. The only SPOF should be whether my body has access to an Internet connection! :) Granted, the quality of the encrypted text file is dependent on your discipline in managing it. However, it's simple and compatible with most *nix systems out of the box. Maybe part of it is how one interacts online, too? I try to reduce the number of accounts I have on the Web. Each one is another potential data leak risk. I might have different needs if I kept signing up to site after site, or needed to manage a brand or something else that's interaction- and account-heavy. Aside from my personal server, I probably have fewer than 10 or 12 passwords to remember or manage. If we add a zero, I see the use for a password manager.

mongol 3y ago
I was naive about vims encryption. I did not realize that an encryption key is not the same as a password. It is much more feasible to brute force vim's encryption than to brute force a login for example. And if I am not mistaken the feature has been removed from vim now.
- zlg_codes 3y ago
  Oh I see, is this part of Vim's built-in stuff? I had no idea Vim could do that, so I used the vim-gnupg plugin to call out to `gpg` on the command line. It's possible that the plain contents of the file are in RAM while the buffer is being worked on, but I haven't taken a look at memory layouts to see how easy it would be to extract a key or buffer contents.
  - mongol 3y ago
    Yes it was called vimcrypt or something like that. The difference compared with gpg is (among other things) that with vimcrypt you could use an arbitrarily short key, say 12 characters, like a password is long. That is much too short to be secure.