4 ms·

http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/ Then use dropbox to keep the .safe file synced across machines

zalew 14y ago
so if someone wants access to all your passwords, he just needs to compromise your dropbox.
- halostatue 14y ago
  If it works at all like 1Password…no. Not if you have even a half-decent master password.
- mkenyon 14y ago
  Something that has happened in the past on more than one occasion.
- rdl 14y ago
  dropbox plus either passphrase brute force (or guessing), or one of (keylogger, compelled disclosure, shoulder surfing, ...) + dropbox. I consider the 1Password file sensitive enough that it shouldn't be online, especially not with dropbox. I'd prefer if there were physical protection for it somehow, too (like a smartcard or FIPS module, which wouldn't allow bulk-export normally, and which might impose other rules on use like 5 passwords per hour when outside my home network, etc.) Same way you handle high-security private keys. (Ultimately I'm not going to be happy until I have a trusted tablet of some kind, but building that either requires being Apple or waiting for WP8 hardware to come out and investing about $5mm in some serious security upgrades. Maybe worthwhile, though, since it solves the general problem of trusting client devices.)
  - dchest 14y ago
    Now sure if PasswordSafe allows using key file, as sbov mentioned above for Keepass, but if it's properly implemented, and you didn't put the key file into Dropbox, it would be pretty much impossible to brute force.
fpgeek 14y ago
While I appreciate the concept, I don't think Dropbox is the company to trust for this kind of thing: http://arstechnica.com/security/2012/07/dropbox-confirms-it-got-hacked-will-offer-two-factor-authentication/ http://arstechnica.com/security/2012/07/dropbox-confirms-it-...
sbov 14y ago
I like to use keepass with a long, memorable password and key file that I need to manually copy across machines. So even if they get my password database and my password they don't have the key file. And if they can get the key file, they could have gotten the password database anyways.

zalew 14y ago

so if someone wants access to all your passwords, he just needs to compromise your dropbox.

halostatue 14y ago
If it works at all like 1Password…no. Not if you have even a half-decent master password.
mkenyon 14y ago
Something that has happened in the past on more than one occasion.
rdl 14y ago
dropbox plus either passphrase brute force (or guessing), or one of (keylogger, compelled disclosure, shoulder surfing, ...) + dropbox. I consider the 1Password file sensitive enough that it shouldn't be online, especially not with dropbox. I'd prefer if there were physical protection for it somehow, too (like a smartcard or FIPS module, which wouldn't allow bulk-export normally, and which might impose other rules on use like 5 passwords per hour when outside my home network, etc.) Same way you handle high-security private keys. (Ultimately I'm not going to be happy until I have a trusted tablet of some kind, but building that either requires being Apple or waiting for WP8 hardware to come out and investing about $5mm in some serious security upgrades. Maybe worthwhile, though, since it solves the general problem of trusting client devices.)
- dchest 14y ago
  Now sure if PasswordSafe allows using key file, as sbov mentioned above for Keepass, but if it's properly implemented, and you didn't put the key file into Dropbox, it would be pretty much impossible to brute force.

fpgeek 14y ago

While I appreciate the concept, I don't think Dropbox is the company to trust for this kind of thing: http://arstechnica.com/security/2012/07/dropbox-confirms-it-got-hacked-will-offer-two-factor-authentication/ http://arstechnica.com/security/2012/07/dropbox-confirms-it-...

sbov 14y ago

I like to use keepass with a long, memorable password and key file that I need to manually copy across machines. So even if they get my password database and my password they don't have the key file. And if they can get the key file, they could have gotten the password database anyways.