Hacker News Reader

Comment by civilized | Hacker News Reader

Confession: I store all my passwords in a plaintext file on my local desktop.

I'm sure some people will look at me very funny for doing this, but it seems to me that I have both fewer hassles logging in and fewer breaches than people using more "secure" methods (like handing your passwords over to LastPass's mystery Chrome extension).

Think about today's threat landscape and tell me I'm wrong. I may not be more secure in every possible situation, but I'm more secure in the situations that cause the vast majority of breaches today.

View on HN

You could just use KeePass: https://keepass.info/

It's a free open source app that runs on your local machine and stores your passwords locally - never uploads your passwords to a server. But it does this securely.

And you can run it on multiple machines (and phones) and transfer the passwords (the vault) without ever uploading anything to servers.

Seems useful, the name gave me a chuckle. If I only saw the URL, I would imagine this was a service that providing info on preserving your buttocks.

It's fitting, good password management is the "watch out for your Cornhole" of the 21st century...

There's a service "keeping donkeys". You can adopt your own <3 https://www.thedonkeysanctuary.org.uk/adopt

Asley looks nice, I always wanted when I get a donkey to name it Ashley.

Keepass is great.

If you like to have synced database between devices with minimal risk of exposure I would recommend setting it up to use a master password AND generated key file. I do this, then sync my database to cloud/butt and just keep my key file offline and on device only.

Edit: I believe you can also use a FIDO/U2F key (yubikey, google titan, etc.) in place of a key file but 2 password lock is great even if someone guesses your master password, the database is still useless without the 2nd key.

Thanks for the tip! I will look into it. I am curious to find out how it syncs without servers. (I assume this is not an incredibly hard problem but we are just not used to doing things without "the cloud" these days)

it doesn't, it's up to you to manage that. you could use rsync, dropbox, google drive, icloud drive, or whatever mechanism for syncing you like.

Use any service you want, Syncthing, Dropbox, etc. Keepass is smart about saving. If the DB is modified in the background while it's open, it will merge your changes rather than overwrite.

Personally, I keep my file on Google Drive and download it wherever it's needed. It does require a bit of manual tracking to ensure I've got the latest file, but I've only got about a handful of devices that I need it for, and even if I don't have the latest version of the file, it just means I might be missing a password for a particular service, and I can quickly download the latest anyway.

Obviously it's not as nice as having a cloud service, but it's open-source and doesn't require trusting a third party, which I like.

Uh, can it be true that the author doesn’t use a source code repository?

I found that KeepassXC is a nicer, multi-platform client https://keepassxc.org/

Confession: I write them down.

My threat model is 100% aimed at remote attacks/hackers. I could not care less about law enforcement. I also use a hardware backed second factor.

That's still an issue. humanly generated passwords tend to be predictable, repetitive and not very long.

A computer will always do a better job at generating\remembering passwords.

hardware 2FA is definitely a good idea.

They aren't human generated. I generate them programmatically and don't store them on silicon but on paper.

Secure paper is one of the best methods.

The issue is when you want to access that paper remotely or on the go. Then it becomes a really bad method.

>humanly generated passwords tend to be predictable, repetitive and not very long.

Not necessarily. See https://xkcd.com/936/

I do this, though I encrypt with GPG and a password. When I open the file, Emacs prompts for the password. It's pretty convenient, honestly, and I use the same system for sensitive notes, etc.

I see nothing wrong with using a plaintext file on your computer, that’s likely going to be safer than using a cloud based solution for a desktop computer that only you access, especially if you don’t have remote access.

Important questions might be how secure is your computer (encrypted HD, multiple users, etc), what incoming services have you enabled (ssh?), does your computer ever travel (is it a laptop, is it prone to loss or theft), and how secure is your apartment/house (is a robbery plausible).

The main thing a desktop file is, for most people who use password managers, is inconvenient. Without some kind of remote access at home, it might mean not having access to passwords when doing errands or traveling, any time when not physically at home. But with remote access, the password file access does become riskier, that does become cloud access where you’re responsible for the security of all methods of remote access (are any ports open you don’t know about?).

Having my password manager on my phone has been incredibly useful at times.

Yeah, if hackers got to your plain text file, they probably also installed a keylogger and clipboard scanner, in which case they have all your passwords, lastpass or not.

Not that your approach doesn't have advantages, but at that point I would just keep them in a paper notebook hidden in my desk.

I'm a lazy bastard.

That's what I do.

The number of times my home's been broken into: 0 (and based on news, virtually all of burglars are just looking for jewelry, wallets, and similar stuff and they won't bother trawling through your papers for passwords).

The number of times I've had devices on my network that run some hastily put together vendor firmware that was last updated six years ago: too many to count.

The number of times I've had to rush to update/patch my own computers to fix a newly disclosed remotely exploitable vuln: quite a few.

The number of times I've actually witnessed attempts at trying to exploit said remote vulns: too many to count! Sometimes mere hours after I've patched my stuff.

The number of times I've known I've had malware: at least a couple times (admittedly long ago, back when I ran Windows..).

I just don't trust keeping personal passwords on online connected computing devices. And password managers are a very lucrative target today (plus it tends to be all eggs in one basket for most people!).

I do keep passwords for employer's stuff in a password manager but not on the same device(s) I use said passwords on; even if you had malware on my work laptop, you wouldn't get my master password, nor would you be able to grab my password database. Passwords are also not stored on any third party service.

The price I pay is a relatively minor inconvenience. (I do have plans for something more convenient though!)

If you want to store you passwords locally, then at least use something like Keepass or KeepassXC. It's far from a perfect solution as it's still vulnerable to targeted attacks when it's being used if your computer is compromised. But at least they're not store in plain text. Also password auto-typing and generation are nice to have.

You can sync the encrypted files to your phone or other computers.

This is why newer versions of MacOS require you to grant permissions for an application to access folders in your user account. If you keep the keepass database in a folder like "secure", then no other program will be able to get to it. On Linux, there are a ton of ways of implementing something similar.

KeepassXC requires authorizing a plugin, and authorizing specific sites before it releases a password.

Inherently less secure than an extension that fills the passwords, as it relies on you checking the URL correctly, while an extension will only fill it when the origin is correct, which means you are less likely to be phished (although a security key is even better for that).

Meh... you're just looking at one threat, and one that isn't remotely likely in my reckoning. I don't think I've ever been phished. It's very easy to spot.

The one that springs to mind was the one that changes the contents of the page while it's in the background to a google log in page—very sophisticated and not something most people were prepared to spot, as people think of following a link as the moment of vulnerability.

Tons of people who are very aware and capable have been phished successfully. If you think it isn't likely, you are likely vulnerable.

"Not very likely" is just obviously not true—phishing is a very common attack, and companies like Google have adopted security keys to protect against it.

I use Vim's built in symmetric encryption with :X

One of the reasons I haven't moved over to NeoVim is because they removed this feature, because supposedly it's not perfect or something. So sure, the NSA may be able to still be able to extract my passwords if they arrest me and take my computer, but the point is that random people won't be able to.

I do the same and encrypt the file with a simple encryption tool.

Good idea. I wish I could be bothered to do this slightly more secure thing to protect my entire livelihood, lol... I'll think about it.

Confession: I use Chrome's built-in password manager.

Reply on news.ycombinator.com