6 ms·
keepass. I don't trust a service to store my passwords. I use a key file and a passphrase to secure my keepass database. The database is stored on dropbox, the
by boydjd 12y ago
keepass. I don't trust a service to store my passwords.
I use a key file and a passphrase to secure my keepass database. The database is stored on dropbox, the keyfile is stored elsewhere.
- JshWright 12y agoSame here. KeePass2 on Linux, KeePassX on OSX, and KeePassDroid.
- mcbetz 12y agoI prefer MacPass over KeePassX, because it support Keepass2 files by default - KeePassX only does in the non-stable version. That's the only annoyance with Keepass: it has two non-compatible file types and you need to stick with one (and hence the supporting software).
- davegauer 12y agoI've had a _great_ experience using KeePassX on both Windows and Linux. I use a sometimes-synced copy of the database on KeePassDroid on my Android phone. Actually, the user experience of KeePassDroid can only be described as vile, but that it works at all (allowing me to have all of my passwords securely available on my person) is awesome enough.
- daddykotex 12y agoI use KeyPass and sync it using BitTorrent sync on all my devices. The problem with my current setup is that I carry the keyfile along with the database which useless. I got to think of another way!
- joeyrobert 12y agoCarry the key file around on a USB drive, perhaps?
- sjmarshy 12y agoI keep my keyfile in another BitTorrent Sync folder, along with all my other dotfiles. At least they're in two different places then!
- UnoriginalGuy 12y agoThis is very close to how LastPass works under the hood. You're storing an encrypted database on their service (just like DropBox in your case). They don't actually store your original master password. The only legitimate security gripe I've ever read about LastPass (and people have focused its security a LOT) is that a bad guy can modify the JavaScript utilised by the extension if they took control of LastPass's servers, and have your plain text master password sent to a third party (assuming no cross-site protections). The actual password database is fairly secure. As is the login process (which can further be strengthened with 2F and various options in the account settings).
- potatosareok 12y agoI don't particularly favor putting all my passwords in an online password manager. So I have some JavaFX gui I made that encrypts a password file (passphrase => PKDF => AES). In total it's like 200 lines of code - GUI, storing pass, generating pass, and rotating master password. The encrypted file I keep synced in my cloud storage. But in retrospect I don't know if this makes any real difference from something like keepass. My encrypted file is transferred over some secure socket, so an attacker can at least a copy of the encrypted file if they either hack the cloud storage provider or somehow hijack my connection. It's not exactly super portable but for sites I care about, I wouldn't log onto them on untrusted computers anyway.