News for hackers. Stuff that matters.
Re:Autofill in password managers can allow login credentials... by dredmorbius on Tuesday July 27, 2021 @02:37AM (#27969337)
That was going to be my suggestion.

I'm a fan of Zettlekasten for notetaking and knowledge management.

Filing passwords on index cards or business cards (3.5x2 in, ~9x5cm), with a sensible indexing system, scales up reasonably well. There's certainly extant physical infrastructure.

The typical person has on the order of about 100 online accounts. Managing even 1,000 accounts in an index card file is at least within reason.

Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge.

Re:Autofill in password managers can allow login credentials... by maccard on Tuesday July 27, 2021 @04:18AM (#27969923)
> Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge.

What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offload that to a third party that I trust.

[0] https://bitwarden.com/help/article/what-encryption-is-used/

Re:Autofill in password managers can allow login credentials... by dredmorbius on Tuesday July 27, 2021 @04:55AM (#27970192)
Not being dependent on some external maintainer outside your preferred editor and encryption tools.

The ability to port to any alternative tools that provide superior capabilities, should the need arise.

Utilising the file using standard shell tools (gpg piped to grep, sed, awk, etc.).

I've been around long enough to see multiple tools come and go. Even PGP itself dates from after the beginning of my professional career with computers (though near the beginning). There are multiple applications, operating systems, and architectures I've used which have been relegated to the dustbin of history. I'm quite leery of becoming dependent on any one specific application or tool, most especially one that that's not been proven across multiple decades and widely adopted.

PGP, GPG, vi/vim, or emacs would all pass my tests. They're available on any system I could conceivably use. Even iOS, though with some difficulty.

Encrypting and syncing a file is simple.

Managing syncs from multiple locations of an encrypted file is ... a bit more complicated. Git might be able to manage that with some hooks.

Re:Autofill in password managers can allow login credentials... by usrusr on Tuesday July 27, 2021 @04:41AM (#27970093)
Your personal convention that would keep you unaffected from bulk attacks targeting the tool used by millions in the same way.
Re:Autofill in password managers can allow login credentials... by pbhjpbhj on Tuesday July 27, 2021 @04:52AM (#27970164)
Security through obscurity, in other words (I've always been a fan, it works as an additional factor; not being sarcastic!).
Re:Autofill in password managers can allow login credentials... by maccard on Tuesday July 27, 2021 @04:45AM (#27970111)
So security through obscurity?
Re:Autofill in password managers can allow login credentials... by tremon on Tuesday July 27, 2021 @06:47AM (#27970898)
I'd call it security through diversity.
Re:Autofill in password managers can allow login credentials... by usrusr on Tuesday July 27, 2021 @05:01AM (#27970235)
Yes, obscurity is great when used as an additional factor.
Re:Autofill in password managers can allow login credentials... by emodendroket on Tuesday July 27, 2021 @07:57AM (#27971365)
If you want a local one, Keepass will do.