Hacker News Reader

Comment by jmclnx | Hacker News Reader

To me, using a Password Manager puts you at risk, no matter which one you use. I cannot speak to windows, but on Linux, I use a encrypted text file via emacs. And to generate passwords:

tr -cd "[:alnum:]" < /dev/urandom | fold -w 20 | sed 10q

And a real TL;DR:

Upgrade your Kaspersky Password Manager

View on HN

How does that encrypted text file put you less at risk than a password manager?

A password manager might have extra features such as browser plugins that provide a larger attack surface, but they can be switched off entirely. So, if you use more functionality than the encrypted text file, you might have more risk, fair enough, but when you use the same functionality, the risk seems comparable (or even: a password manager seems to offer somewhat more functionality for comparable risk).

Mainly I am in control of it, not a company that may or may not have access to what you are doing.

For example, that company may not be able to see your passwords. But they probably can see the servers/sites the passwords are for and maybe the hash.

I will not even speak about all the break-ins that seem to be occurring on CLoud Systems.

If you're happy with the command line, using something like pass (https://www.passwordstore.org/) is worth serious consideration rather than rolling your own. It is GPLv2 and has a number of benefits, including the fact that your passwords are stored encrypted in a git repo and if you do "pass edit" it will call out to $EDITOR to do your edits, putting encryption/decryption and git transparently on both sides.

Unless you're a cryptographer, don't even think about rolling your own crypto (I'm not one, I did, and I'm ashamed of myself).

The context here was rolling your own password manager, not cryptography.

Really? what about memory protection? temp file cleanup? keylogging?

Encryption? what kind of KDF are you using? probably something old and quite brittle when it comes to hardware cracking.

sit this one down boy

Reply on news.ycombinator.com