News for hackers. Stuff that matters.
Re:Quora User Data Compromised by pmontra on Tuesday December 04, 2018 @01:37AM (#18596902)
I use keepassx, a local password manager. I don't trust centralized online password managers with browser extensions. Huge attack surface. I copy and paste usernames and passwords.
Re:Quora User Data Compromised by stef25 on Tuesday December 04, 2018 @03:31AM (#18597498)
Same. Where do you keep the db file? Mine's in the cloud and I can't help but think it reduces security, but then I need access to this data from various locations.
Re:Quora User Data Compromised by walton_simons on Tuesday December 04, 2018 @05:23AM (#18598105)
I worry about this too. I store the database itself in Dropbox, and I also use a keyfile alongside the password to open it. I can easily recreate the keyfile on any computer, but it never goes anywhere near the internet.

In addition to that, for my really critical "gatekeeper" accounts, I don't put the full password in the database. Just a reminder that this is a "special" password, which needs to be combined with another bit of info in order to work.

I just live with the fact that I can't use this system on my phone, and for my usage patterns, that's fine. There's nothing I need to do that's so urgent that it can't wait until I'm back in front of my computer.

Re:Quora User Data Compromised by taco_emoji on Tuesday December 04, 2018 @05:04PM (#18603997)
Why can't you use it on your phone? There are various apps for Keepass available.
Re:Quora User Data Compromised by pmontra on Tuesday December 04, 2018 @04:06AM (#18597703)
On my laptop. I synch to my phone and tablet using Syncthing. I write into the file only on the laptop.
Re:Quora User Data Compromised by pimeys on Tuesday December 04, 2018 @06:36AM (#18598482)
I keep my db in my own freenas box and sync it between devices using resilio sync.
Re:Quora User Data Compromised by beatgammit on Tuesday December 04, 2018 @07:53AM (#18598928)
I use BitWarden, and they let you self host the service if you want. I haven't done it yet, but I'm definitely considering it. However, passwords are encrypted on your machine then uploaded, so it's a bit more secure than them managing everything on the server.
Re:Quora User Data Compromised by kiriakasis on Tuesday December 04, 2018 @04:47AM (#18597926)
I also do that (almost, keeweb + dropbox) and copy paste logins, but a serious problem is that you need to clear the clipboard after, otherwise any other site you visit can read it.
Re:Quora User Data Compromised by deeg on Tuesday December 04, 2018 @09:02AM (#18599453)
Dunno about Keeweb but KeePass automatically wipes the clipboard after a configurable number of seconds.
Re:Quora User Data Compromised by mk89 on Tuesday December 04, 2018 @02:16AM (#18597067)
Same here! Except I use Keychain (without icloud) from OSX, as it's built in.

I can't trust a website to keep all my passwords.

Re:Quora User Data Compromised by Angostura on Tuesday December 04, 2018 @04:34AM (#18597856)
I basically decided to trust Apple’s privacy and security teams so iCloud Keychain is the one service that I use it syncing.