Re:How to Safely Store Your Users' Passwords in 2016
by dheera on Thursday February 18, 2016 @12:22AM
(#11123883)
Not really. I don't oppose using a master password, which I don't use anywhere directly or store on disk anywhere. I just don't want to trust closed-source code to manage passwords, and want to be able to generate the password to anything from anywhere without having to carry around an encrypted table of stored passwords. In this case, I implement it myself, with the help of some common open-source Python libraries.
[ Parent
| on HN ]
Re:How to Safely Store Your Users' Passwords in 2016
by equivrel on Thursday February 18, 2016 @05:51AM
(#11124930)
Have a look at pass [1], it's a minimalist tool in bash that is so simple you can easily make adjustments to it yourself. The codebase is very small so it is easy to audit. The principle is that your password are encrypted with your public key. You can then use git to keep running copies of your encrypted passwords on many devices.
Re:How to Safely Store Your Users' Passwords in 2016
by dheera on Thursday February 18, 2016 @09:55AM
(#11126123)
Thanks! This is interesting.
Re:How to Safely Store Your Users' Passwords in 2016
by sarciszewski on Thursday February 18, 2016 @12:31AM
(#11123910)
I did say "morally equivalent" rather than "technologically equivalent".
By that, I mean the overall security of your password scheme is analogous to what people get out of a password manager.
Re:How to Safely Store Your Users' Passwords in 2016
by tokenizerrr on Thursday February 18, 2016 @05:31AM
(#11124839)
Password managers are more secure. Here you just need the master password, with password managers you need the master password and the database file.
Still, a lot better than password re-use.
Re:How to Safely Store Your Users' Passwords in 2016
by tokenizerrr on Thursday February 18, 2016 @05:30AM
(#11124837)
> I just don't want to trust closed-source code to manage passwords
KeePass? It's great, and open source.