Re:Quora User Data Compromised
by pmontra on Tuesday December 04, 2018 @01:37AM
(#18596902)
I use keepassx, a local password manager. I don't trust centralized online password managers with browser extensions. Huge attack surface. I copy and paste usernames and passwords.
[ Parent
| on HN ]
Same. Where do you keep the db file? Mine's in the cloud and I can't help but think it reduces security, but then I need access to this data from various locations.
Re:Quora User Data Compromised
by walton_simons on Tuesday December 04, 2018 @05:23AM
(#18598105)
I worry about this too. I store the database itself in Dropbox, and I also use a keyfile alongside the password to open it. I can easily recreate the keyfile on any computer, but it never goes anywhere near the internet.
In addition to that, for my really critical "gatekeeper" accounts, I don't put the full password in the database. Just a reminder that this is a "special" password, which needs to be combined with another bit of info in order to work.
I just live with the fact that I can't use this system on my phone, and for my usage patterns, that's fine. There's nothing I need to do that's so urgent that it can't wait until I'm back in front of my computer.
Re:Quora User Data Compromised
by taco_emoji on Tuesday December 04, 2018 @05:04PM
(#18603997)
Why can't you use it on your phone? There are various apps for Keepass available.
On my laptop. I synch to my phone and tablet using Syncthing. I write into the file only on the laptop.
I keep my db in my own freenas box and sync it between devices using resilio sync.
Re:Quora User Data Compromised
by beatgammit on Tuesday December 04, 2018 @07:53AM
(#18598928)
I use BitWarden, and they let you self host the service if you want. I haven't done it yet, but I'm definitely considering it. However, passwords are encrypted on your machine then uploaded, so it's a bit more secure than them managing everything on the server.
Re:Quora User Data Compromised
by kiriakasis on Tuesday December 04, 2018 @04:47AM
(#18597926)
I also do that (almost, keeweb + dropbox) and copy paste logins, but a serious problem is that you need to clear the clipboard after, otherwise any other site you visit can read it.
Dunno about Keeweb but KeePass automatically wipes the clipboard after a configurable number of seconds.
Same here! Except I use Keychain (without icloud) from OSX, as it's built in.
I can't trust a website to keep all my passwords.