More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user::Security experts believe some of the LastPass password vaults stolen during a security breach last year have now been cracked open following a string of cryptocurrency heists
Any obvious holes in keeping a text file on my laptop that I encrypt when not using it? Using ccrypt on linux.
I do not want my passwords - even encrypted - on the cloud or at the mercy of a 3rd party in any fashion.
Use KeePass.
My concern with using a text file is you have to defrost it to use it and whenever it’s not encrypted it’s potentially exposed. You are also vulnerable to keyloggers or clipboard captures
KeePass works entirely locally, no cloud. And it’s far more secure/functional than a text file.
I personally use KeePass, secured with a master password + YubiKey.
Then I sync the database between devices using SyncThing over a Tailscale network.
KeePass keeps the data secure at rest and transferring is always done P2P over SSL and always inside a WireGuard network so even on public networks it’s protected.
You could just as easily leave out the Tailscale/SyncThing and just manually transfer your database using hardware air-gapped solutions instead but I am confident in the security of this solution for myself. Even if the database was intercepted during transit it’s useless without the combined password/hardware key.
Absolutely, Keepass is a great alternative to cloud managed password managers.
Keepass (and most password managers) are vulnerable to this as well.
Not if you use the browser extension
Plus it does automatically clear the clipboard after a short time which isn’t perfect but it’s still an improvement over using a text file
True, but KeePass has some countermeasures, like wiping the clipboard after some time, sending the password directly to a browser extension, or entering the master password on a “secure desktop” (technically not all that secure, but more secure than the lack of it).
Why not use KeePass then? It’s entirely local and you don’t have to risk running your own encryption solution.
If you care about security, use FDE. Then a text file with proper file permissions is probably fine.
Would cloudless self hosting count? https://keepassxc.org/
Yes, if you write the decrypted file to disk, it could be recovered. Deleting files only removes the file system entries - it does not wipe the content.
Use a local password manager. KeePass (use the KeePassXC variant on Linux) is the most popular choice. If you prefer a command line tool, pass (passwordstore.org) is an option.
Thanks, great point. Lots of suggestions for KeePass here, so I’ll definitely look into it. I appreciate the command line tool recommendation as well, as that’s my preference. Cheers!