Re:Ask HN: Password manager with best experience on Linux?
by tzs on Tuesday June 25, 2019 @02:58PM
(#20277622)
> If you go on listing the issues, you wind up writing the requirements document for a password manager.
One difference, though, is that most of the issues can be addressed by some sort of persistent data store that does not need high security. Once you've taken the passwords themselves out of what your password manager stores, I think this is the only thing on your list that requires storing highly sensitive data:
> What about extraneous crap like security questions, phone PINs, emails, related sites, &c.?
For the rest, such as some sort of per site version serial number to handle password rotation, or a map from current site name to original site name for sites whose names have changed, it is also sensitive data, but it is on a level of sensitivity like a contact list or browser bookmarks for which your ordinary OS security mechanisms for file protection should be sufficient.
One difference, though, is that most of the issues can be addressed by some sort of persistent data store that does not need high security. Once you've taken the passwords themselves out of what your password manager stores, I think this is the only thing on your list that requires storing highly sensitive data:
> What about extraneous crap like security questions, phone PINs, emails, related sites, &c.?
For the rest, such as some sort of per site version serial number to handle password rotation, or a map from current site name to original site name for sites whose names have changed, it is also sensitive data, but it is on a level of sensitivity like a contact list or browser bookmarks for which your ordinary OS security mechanisms for file protection should be sufficient.