5 ms·

It's a bad idea to trust your secrets with a proprietary web service. Free software is a prerequisite for digital security. Best to use a free software passwo

It's a bad idea to trust your secrets with a proprietary web service. Free software is a prerequisite for digital security. Best to use a free software password manager that you can run on your own computer.

keypusher 13y ago
And what do I do when I have 3 or 4 devices? Home desktop, work desktop, laptop, tablet, etc?
- sliverstorm 13y ago
  Couple options 1) Dropbox 2) USB stick
- kcorbitt 13y ago
  I keep my KeePass database synced between devices using a Dropbox-like service that I self-host, so the file is never out of my control. But even if someone grabs the database off my machine or in transit, it's no good if they don't know my master password.
- tokenizerrr 13y ago
  KeePass ftp sync, or what sliverstorm said
- _jwo_ 13y ago
  I've been using http://www.zx2c4.com/projects/password-store/ http://www.zx2c4.com/projects/password-store/ which handles that by integrating with Git, encrypted passwords are stored in a Git repo and all changes are recorded as Git commits. It's no more difficult than using a centralized third-party service, provided you have somewhere to host a Git server for it.
- blueskin_ 13y ago
  KeePass has a basic builtin sync, with addons for more/better protocols, or if you primarily use one device with others as more readonly, you can just copy the file yourself.
tempestn 13y ago
As recent events have clearly demonstrated, FOSS is by no means immune to security holes. Is paid, closed-source software less secure? On one hand, it does lack community oversight of the code base. (Although clearly with a sufficiently complex code base, backdoors can exist for years without anyone noticing anyway, and it could be argued that intentional back doors would be more easily installed in open source projects.) On the other hand though, paid software is operated by a team whose job it is to keep the service secure. All that aside though, I certainly can't see any logical argument for the statement "Free software is a prerequisite for digital security." It could be argued that open source software is such a prerequisite (although I wouldn't necessarily agree), but if anything I expect that paying for software would ultimately tend to make it more secure.
antsar 13y ago
Why was this downvoted? Seems like sound advice not to drop the keys to your kingdom into a black box run by a business...
- Karunamon 13y ago
  Because it's typical free-software-uber-alles posturing lacking logic. Besides, it lacks applicability in this case. LP encrypts all your stuff client side before sending it along for storage, and the browser plugins that handle this are open source by way of being browser plugins. Whatever happens server side after that is mostly irrelevant.
  - antsar 13y ago
    Thanks for clarifying. I wasn't aware that LastPass encrypts your stuff client-side with auditable code, that does change things.

keypusher 13y ago

And what do I do when I have 3 or 4 devices? Home desktop, work desktop, laptop, tablet, etc?

sliverstorm 13y ago
Couple options 1) Dropbox 2) USB stick
kcorbitt 13y ago
I keep my KeePass database synced between devices using a Dropbox-like service that I self-host, so the file is never out of my control. But even if someone grabs the database off my machine or in transit, it's no good if they don't know my master password.
tokenizerrr 13y ago
KeePass ftp sync, or what sliverstorm said
_jwo_ 13y ago
I've been using http://www.zx2c4.com/projects/password-store/ http://www.zx2c4.com/projects/password-store/ which handles that by integrating with Git, encrypted passwords are stored in a Git repo and all changes are recorded as Git commits. It's no more difficult than using a centralized third-party service, provided you have somewhere to host a Git server for it.
blueskin_ 13y ago
KeePass has a basic builtin sync, with addons for more/better protocols, or if you primarily use one device with others as more readonly, you can just copy the file yourself.

tempestn 13y ago

As recent events have clearly demonstrated, FOSS is by no means immune to security holes. Is paid, closed-source software less secure? On one hand, it does lack community oversight of the code base. (Although clearly with a sufficiently complex code base, backdoors can exist for years without anyone noticing anyway, and it could be argued that intentional back doors would be more easily installed in open source projects.) On the other hand though, paid software is operated by a team whose job it is to keep the service secure. All that aside though, I certainly can't see any logical argument for the statement "Free software is a prerequisite for digital security." It could be argued that open source software is such a prerequisite (although I wouldn't necessarily agree), but if anything I expect that paying for software would ultimately tend to make it more secure.

antsar 13y ago

Why was this downvoted? Seems like sound advice not to drop the keys to your kingdom into a black box run by a business...

Karunamon 13y ago
Because it's typical free-software-uber-alles posturing lacking logic. Besides, it lacks applicability in this case. LP encrypts all your stuff client side before sending it along for storage, and the browser plugins that handle this are open source by way of being browser plugins. Whatever happens server side after that is mostly irrelevant.
- antsar 13y ago
  Thanks for clarifying. I wasn't aware that LastPass encrypts your stuff client-side with auditable code, that does change things.