Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #1466 > unrolled thread

Ask Usenet: How do you manage your passwords?

Back to article view | Back to comp.misc

Contents

  Ask Usenet: How do you manage your passwords? Randy Westlund <Vorzakir@invalid.invalid> - 2014-03-11 16:18 +0000
    Re: Ask Usenet: How do you manage your passwords? Rich <rich@example.com> - 2014-03-11 17:14 +0000
      Re: Ask Usenet: How do you manage your passwords? Randy Westlund <Vorzakir@invalid.invalid> - 2014-03-11 21:14 +0000
        Re: Ask Usenet: How do you manage your passwords? Rich <rich@example.com> - 2014-03-12 02:49 +0000
          Re: Ask Usenet: How do you manage your passwords? Randy Westlund <Vorzakir@invalid.invalid> - 2014-03-12 04:08 +0000
            Re: Ask Usenet: How do you manage your passwords? Oregonian Haruspex <bob_davis_retired@yahoo.com> - 2014-03-12 08:08 +0000
              Re: Ask Usenet: How do you manage your passwords? Randy Westlund <Vorzakir@invalid.invalid> - 2014-03-12 08:26 +0000
    Re: Ask Usenet: How do you manage your passwords? Tim Watts <tw_usenet@dionic.net> - 2014-03-11 17:20 +0000
      Re: Ask Usenet: How do you manage your passwords? Jerry Peters <jerry@example.invalid> - 2014-03-11 20:24 +0000
        Re: Ask Usenet: How do you manage your passwords? Tim Watts <tw_usenet@dionic.net> - 2014-03-11 20:48 +0000
    Re: Ask Usenet: How do you manage your passwords? Oregonian Haruspex <bob_davis_retired@yahoo.com> - 2014-03-11 19:49 +0000
    Re: Ask Usenet: How do you manage your passwords? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-03-11 20:49 +0000
    Re: Ask Usenet: How do you manage your passwords? "Andy K." <andy.k466@gmail.com> - 2014-03-11 23:17 +0100
      Re: Ask Usenet: How do you manage your passwords? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-03-12 01:01 +0000
      Re: Ask Usenet: How do you manage your passwords? Huge <Huge@nowhere.much.invalid> - 2014-03-12 09:43 +0000
        Re: Ask Usenet: How do you manage your passwords? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-03-12 21:15 +0000
    Re: Ask Usenet: How do you manage your passwords? Dave Royal <dave@dave123royal.com> - 2014-03-12 08:04 +0000
      Re: Ask Usenet: How do you manage your passwords? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-03-12 08:58 +0000
        Re: Ask Usenet: How do you manage your passwords? Dave Royal <dave@dave123royal.com> - 2014-03-12 09:07 +0000
        Re: Ask Usenet: How do you manage your passwords? Memnon Anon <memnon+usenet@freeshell.org> - 2014-03-12 11:04 +0000
          Re: Ask Usenet: How do you manage your passwords? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-03-12 21:04 +0000
    Re: Ask Usenet: How do you manage your passwords? Morten Nygaard Åsnes <mnaasnes@gmail.com> - 2014-03-12 12:46 +0100
    Re: Ask Usenet: How do you manage your passwords? Spalls Hurgenson <spallshurgenson@gmail.com> - 2014-03-12 10:16 -0400
    Re: Ask Usenet: How do you manage your passwords? RS Wood <rsw@therandymon.com> - 2014-03-12 14:21 +0000
      Re: Ask Usenet: How do you manage your passwords? Rich <rich@example.com> - 2014-03-12 16:21 +0000
      Re: Ask Usenet: How do you manage your passwords? David Jones <david.jones@fmail.co.uk> - 2014-03-12 16:43 +0000
        Re: Ask Usenet: How do you manage your passwords? RS Wood <rsw@therandymon.com> - 2014-03-12 17:14 +0000
          Re: Ask Usenet: How do you manage your passwords? Randy Westlund <Vorzakir@invalid.invalid> - 2014-03-13 06:32 +0000
    Re: Ask Usenet: How do you manage your passwords? "q.kontinuum" <achsis_of_elvis@yahoo.co.uk> - 2014-03-17 07:41 +0100

Page 2 of 2 — ← Prev page 1 [2]

#1538

In message <ynpu8usfhe42.fsf@odin.sdf-eu.org> 
  Memnon Anon <memnon+usenet@freeshell.org> wrote:
> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:

>> In message <lfp4eo$mue$1@dont-email.me> 
>> Dave Royal <dave@dave123royal.com> wrote:
>>> On Tue, 11 Mar 2014 16:18:37 +0000, Randy Westlund wrote:
>>> Text file, symmetrically encrypted with GPG. 

>+1. 

>> Doesn't allow you to store screeshots, scans of important documents, 

> ? 
> This thread is about storing your passwords in a secure way.
> How exactly are scans of important documents related to that?

They are also things that you need to store securely in a digital form
(well, at least I do.)

-- 
You could save people. You could get there in the nick of time. And
something could snap its fingers and say, no , it has to be that way.
Let me tell you how it has to be. This is how the legend goes. --Soul
Music

[toc] | [prev] | [next] | [standalone]

#1514

On 2014-03-11, Randy Westlund <Vorzakir@invalid.invalid> wrote:
> I'm really curious about password managers such as LastPass,
> KeePass, and pass.
>
> https://lastpass.com/
> http://keepass.info/
> http://www.zx2c4.com/projects/password-store/
>
> I really like the ability to use ridiculously strong passwords, but
> I'm concerned about limited accessibility to them.  What if I need
> to check my account balance on my phone when I'm out at a store
> somewhere?  What if I'm on someone else's windows machine and can't
> ssh into my server (assuming I use pass) or my browser plugins
> (assuming I use a browser-based utility).  This is the trade-off
> between security and convenience, and finding the right balance is
> difficult.
>
> For those of you who use password managers, how do you handle these
> situations?  For those of you who don't, what password management
> strategy do you use?

I use Lastpass for all my passwords (including wifi passwords, router 
passwords, and things like that). I have a long phrase as my master 
password, in addition to using two-factor authentication with Google
Authenticator for extra security. There is an Android app for Lastpass,
so I always have access to my passwords, as long as I have my phone with
me (always).

-- 
~
~
~
:wq

[toc] | [prev] | [next] | [standalone]

#1515

On Tue, 11 Mar 2014 16:18:37 +0000 (UTC), Randy Westlund
<Vorzakir@invalid.invalid> wrote:

0
>I'm really curious about password managers such as LastPass,
>KeePass, and pass.
>
>https://lastpass.com/
>http://keepass.info/
>http://www.zx2c4.com/projects/password-store/


I've been happy using individual TXT files for each website, then all
stored in a TrueCrypt container with a nice strong password. I keep
the file itself on the local network, accessible by all home PCs, with
a synced copy on the laptops.

Even use it on my smartphone, where it is triply protected (PIN on the
phone, PIN to access to the app, then password on the truecrypt file;
given the strength of the last, the first two are probably redundant
;-).

If I /really/ wanted to, I guess I could also put the truecrypt file
on dropbox or similar but - strong as my password may be - putting it
out on the net just seems to be tempting fate. Anyway, putting it on
dropbox would mainly be so I could access the file on the road, which
would probably mean using either an untrustworthy network or computer.
So I don't see the point.

I prefer using TXT files because it allows me to customize the
information more than most password stores. So not only can I keep
track of username and password, but also the answers to those "secret
questions", old passwords, purchase dates, etc. Plus, as necessary I
can add in non-TXT files (for instance, I have a spreadsheet with all
my Serial numbers for software products).  And I personally find
navigating a file system to be faster than working through the index
of any app (although YMMV).

Not saying my way is the best way, but it works for me. The only major
disadvantage is that I need to have compatible software (e.g., a
TrueCrypt client) on every PC. Fortunately, Truecrypt decryptors are
available on almost every major platform so it isn't much of a
problem.

[toc] | [prev] | [next] | [standalone]

#1516

On Tue, 11 Mar 2014 16:18:37 +0000 (UTC)
Randy Westlund <Vorzakir@invalid.invalid> wrote:

> My parents had their ebay account hacked last night, and the guy who
> had control of it was buying dodgecoin and litecoin as fast as he
> could.  I'm helping them deal with the situation, and finally
> convinced them not to use the same dictionary word as a password on
> all their accounts.  The incident has caused me to reflect on how I
> can better manage my own passwords.
> 
> Currently, I use a common crappy password on unimportant sites, and
> a serious one for important accounts with a common base that varies
> based on the domain name.  But I'm worried that if a human were to
> recover the plaintext of my password for one site, they may be able
> to figure out my passwords for other sites as well.
> 
> I'm really curious about password managers such as LastPass,
> KeePass, and pass.
> 
> https://lastpass.com/
> http://keepass.info/
> http://www.zx2c4.com/projects/password-store/
> 
> I really like the ability to use ridiculously strong passwords, but
> I'm concerned about limited accessibility to them.  What if I need
> to check my account balance on my phone when I'm out at a store
> somewhere?  What if I'm on someone else's windows machine and can't
> ssh into my server (assuming I use pass) or my browser plugins
> (assuming I use a browser-based utility).  This is the trade-off
> between security and convenience, and finding the right balance is
> difficult.
> 
> For those of you who use password managers, how do you handle these
> situations?  For those of you who don't, what password management
> strategy do you use?


I use DataVault on my Android phone as I have something like 200 unique
passwords.  It works great on a high end phone but also worked well on
Gingerbread.  I chose it because they also sell a Mac OSX app that
allows me to back up my phone and/or synchronize it to my Mac.  I'm not
comfortable with cloud storage of really any type, thinking if they get
my password file they've got it all.

I find Datavault good, but it's expensive as phone apps go - $9 or
something.  Paid apps tend to be better quality in my opinion, as the
understanding of customer/client 'rights' is clearer.

*Somewhere* recently I just saw mention of a *Nix CLI password app that
people seem to like, and for the life of me I can't remember where I
saw it or what the app was, but it seemed interesting to me at the time.

[toc] | [prev] | [next] | [standalone]

#1526

RS Wood <rsw@therandymon.com> wrote:
> On Tue, 11 Mar 2014 16:18:37 +0000 (UTC)
> Randy Westlund <Vorzakir@invalid.invalid> wrote:

> > For those of you who use password managers, how do you handle these
> > situations?  For those of you who don't, what password management
> > strategy do you use?

> ...

> *Somewhere* recently I just saw mention of a *Nix CLI password app
> that people seem to like, and for the life of me I can't remember
> where I saw it or what the app was, but it seemed interesting to me
> at the time.

Was it possibly this?: http://nsd.dyndns.org/pwsafe/

[toc] | [prev] | [next] | [standalone]

#1528

RS Wood <rsw@therandymon.com> writes:

> *Somewhere* recently I just saw mention of a *Nix CLI password app that
> people seem to like, and for the life of me I can't remember where I
> saw it or what the app was, but it seemed interesting to me at the time.

I've been using pass[1] for a week or so, it stores passwords as
GPG-encrypted files under a directory hierarchy.  I'm appreciating the
simplicity compared to GUI apps like keepassx.

[1]: http://www.zx2c4.com/projects/password-store/

[toc] | [prev] | [next] | [standalone]

#1530

 David Jones <david.jones@fmail.co.uk> Wrote in message:
> RS Wood <rsw@therandymon.com> writes:
> 
>> *Somewhere* recently I just saw mention of a *Nix CLI password app that
>> people seem to like, and for the life of me I can't remember where I
>> saw it or what the app was, but it seemed interesting to me at the time.
> 
> I've been using pass[1] for a week or so, it stores passwords as
> GPG-encrypted files under a directory hierarchy.  I'm appreciating the
> simplicity compared to GUI apps like keepassx.
> 
> [1]: http://www.zx2c4.com/projects/password-store/
> 

That's the one.  Thanks!
-- 

[toc] | [prev] | [next] | [standalone]

#1547

On 2014-03-12, RS Wood wrote:
>  David Jones <david.jones@fmail.co.uk> Wrote in message:
>> RS Wood <rsw@therandymon.com> writes:
>> 
>>> *Somewhere* recently I just saw mention of a *Nix CLI password app that
>>> people seem to like, and for the life of me I can't remember where I
>>> saw it or what the app was, but it seemed interesting to me at the time.
>> 
>> I've been using pass[1] for a week or so, it stores passwords as
>> GPG-encrypted files under a directory hierarchy.  I'm appreciating the
>> simplicity compared to GUI apps like keepassx.
>> 
>> [1]: http://www.zx2c4.com/projects/password-store/
>> 
>
> That's the one.  Thanks!

This is the one I'd really like to use.  What I really like about
pass:

- dead simple, just strings together existing tools
- can store passwords in a directory structure that I can browse
  myself
- I can access everything by invoking gpg manually, bypassing pass
  entirely
- native git integration, for password version control and syncing

But I can't find a reasonable way to access this from android.
There's an experimental iOS app, but nothing for android :(

The other reasonable CLI manager is pwsafe.  Because it uses the
Password Safe file format, it's compatible with that whole family --
Password Safe, Password Gorilla, PasswdSafe (android), etc.

So unless someone here has figured out how to use pass from android,
it looks like I'll be running with pwsafe.

[toc] | [prev] | [next] | [standalone]

#1702

On 2014-03-11, Randy Westlund <Vorzakir@invalid.invalid> wrote:

> Currently, I use a common crappy password on unimportant sites, and
> a serious one for important accounts with a common base that varies
> based on the domain name.  

I do the same.

> But I'm worried that if a human were to
> recover the plaintext of my password for one site, they may be able
> to figure out my passwords for other sites as well.

Then make sure, noone gets the plaintext password :-)
I usually use a base-password + something site-based, feed it to a
hashing algorithm and then use the base64 encoded output as a 
password. For base64-encoding, I have a Javascript on my homepage,
whith a manifest file do cache it as a HTML5 app - works offline,
does not go through an App-store.

I imagine there is still a risk someone could hack this
scheme by having a key-logger on my system or by hacking my homepage
and modifying the javascript, but that would have to be a targeted,
personalized attack; I just assume I'm neither rich nor important 
enough for that.


-- 
Trolling is a art!

My public-key is available on http://tinyurl.com/ps9r99y

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.misc

csiph-web