News for hackers. Stuff that matters.
Re:KeePassXC 2.5.2 by newscracker on Sunday January 05, 2020 @07:00AM (#21960898)
Is there a good “secrets manager” or “encrypted information manager” that’s free (preferably also open source) or quite cheap (not subscription based), is multi-platform (including mobile) and supports auto-fill in other applications (especially browsers)?

Password managers with password generators and 2FA code generators are ok for work related use, but they usually may not cover other pieces of information, like credit/debit cards, software licenses, identification cards, hardware/appliances, etc. Adding custom fields in each entry by oneself isn’t a great option. Perhaps it’s not a great idea (even with a very strong master password) to put all the information in one database, but I see value in being able to store, retrieve and auto fill different kinds of information (even if some may seem too complex to define in a generic schema).

I already tried Bitwarden, but it covers only passwords, cards and identities (plus secure notes).

Re:KeePassXC 2.5.2 by upofadown on Sunday January 05, 2020 @07:33AM (#21961005)
Boring old Unix Pass?

* https://www.passwordstore.org/

It's just a bunch of gpg encrypted files with as much stuff as you want in them, in any format you want (password on first line). Easy to share/sync to whatever you want. Lots of interfaces on lots of platforms but you really don't need an interface.

Has git support...

Re:KeePassXC 2.5.2 by iudqnolq on Sunday January 05, 2020 @02:05PM (#21963176)
Highschool me fucked up pass and exposed a lot of data. It was entirety my own fault, but there are footguns if you don't fully understand the model.

Essentially, I accidentally publicly exposed my private key. I thought I was clever for writing a Python script to dump all my passwords and then re-add them after setting up pass with a new key.

A year later, when I accidentally deleted my private key (reformatted laptop, phone bricked before set laptop back up), I spent a few hours trying to figure out if I made a mistake that would let me recover my passwords. I was very motivated :)

Eventually, I realized that since I'd been using git to sync pass between my phone and computer (the recommended setup) I could access versions of my encrypted data for every account more than a year old and decrypt them with the private key I leaked. I got back almost all my data.

Luckily I was using a private git repository for defense in depth, but many guides recommend a public reposity because they say gpg is very strong.

It all works, but only if you don't do something dumb like I did. Now I'm on 1password and happy knowing that experienced people are paid to make it and smart security researchers like Troy Hunt (of haveibeenpwned fame) have said it's the most secure password manager they've looked into.

(I said the same thing earlier in a different post)

Re:KeePassXC 2.5.2 by upofadown on Sunday January 05, 2020 @03:25PM (#21963795)
I take it that you had no passphrase on your private key?
Re:KeePassXC 2.5.2 by iudqnolq on Sunday January 05, 2020 @05:12PM (#21964523)
I did, but I presumed that I should still change the key once it was exposed. IIRC it was a nonrandom long passphrase (the first letter of every word in a 20-30 word sentence, I think. I've since moved to memorizing random passphrases). I was able to remember that password when I needed to recover the data later.
Re:KeePassXC 2.5.2 by vbezhenar on Sunday January 05, 2020 @09:43AM (#21961412)
Try KeePass. There's .NET implementation for Windows, there're few cross-platform C++ implementations for Linux and macOS, there are integrations with browser, there are mobile clients and you can configure sync as you like. For example I'm using KeePass on Windows desktop, synchronize it to my WebDAV server and then synchronize it with KeePassium iOS app. It works well and I control every single bit of it (I don't use browser extension because I think that it's too dangerous to let all my passwords to be accessible by something running in browser, but it's possible if you don't care). Simpler option for synchronization is dropbox which is popular among many users and works just as well.
Re:KeePassXC 2.5.2 by joelthelion on Sunday January 05, 2020 @07:46AM (#21961037)
Firefox Lockwise? Not sure if it supports all of your use cases though.
Re:KeePassXC 2.5.2 by BillinghamJ on Sunday January 05, 2020 @08:20AM (#21961127)
I don't really understand why Keybase hasn't pushed into this area. It seems like an obvious addition along with their other team services and new tools like git
Re:KeePassXC 2.5.2 by owaislone on Sunday January 05, 2020 @08:33AM (#21961166)
I've been using CryFS with Google Drive for any kind of sensitive information and it has worked wonderfully well so far. I mostly store sensitive documents, encryption keys, 2FA setup and reset codes in there. A password manager could easily be built on top of it.
Re:KeePassXC 2.5.2 by projektfu on Sunday January 05, 2020 @09:09AM (#21961290)
LastPass is free for single users. It’s good at holding secure notes and cards. It appears to encrypt everything client side. Not open source.

Emacs is good at automatically keeping gpg files. Not sure about mobile support.

Re:KeePassXC 2.5.2 by projektfu on Sunday January 05, 2020 @11:41AM (#21962070)
Also apparently one of these tools has a lot of detractors. Who knew?
Re:KeePassXC 2.5.2 by avel on Sunday January 05, 2020 @10:56AM (#21961797)
I use Enpass. I believe it ticks all your boxes.
Re:KeePassXC 2.5.2 by vivekf on Sunday January 05, 2020 @10:50AM (#21961765)
Take a look at hashicorp's vault
Re:KeePassXC 2.5.2 by rv-de on Sunday January 05, 2020 @08:19AM (#21961123)
password safe (pwsafe.org) - I just use the "notes" text input.