How do you guys keep track of all you vps's login data?

Garrett

@joepie91 said: instead of just getting a list of services, they get a list of services you actively use.

Wouldn't they be getting that regardless of how the passwords are stored?

And kpcli isn't in the debian repos, so its still more work installing than I'd like to deal with (yes, I'm lazy, I already know, please don't tell me )

winston

I use a few different pubkeys and save the SSH IP + Port in a text file on a flash drive with the pubkey username.

I don't trust other providers with my account details.

joepie91

@Garrett said: Wouldn't they be getting that regardless of how the passwords are stored?

No. Your KeePass database may very well have passwords for services that you haven't used for months/years, or have effectively already abandoned.

@Garrett said: And kpcli isn't in the debian repos, so its still more work installing than I'd like to deal with (yes, I'm lazy, I already know, please don't tell me )

sighs

Raymii

@joepie91 said: Not really. If someone were to keylog your machine, they could just as easily monitor the input you give to that shell script. It actually gives them more useful information - instead of just getting a list of services, they get a list of services you actively use.

On screen keyboard for this one.

And @joepie91 is right, I thought of that also one time and then switched to keepass. Make sure you backup the keepass file regularly, I've had more than 1 file corrupting on me...

craigb

For command line junkies, I recommend password-store....a thin wrapper around shell commands and gpg2: http://zx2c4.com/projects/password-store/

bdtech

@joepie91 Like I said I pull a random subset of a string from GRC. Plenty secure

joepie91

@craigb said: For command line junkies, I recommend password-store....a thin wrapper around shell commands and gpg2: http://zx2c4.com/projects/password-store/

Hmm, how does it secure your stored passwords? It's not really clear to me from reading the page.

@bdtech said: @joepie91 Like I said I pull a random subset of a string from GRC. Plenty secure

As I already explained, that means GRC has your password, even if it's just a random subset. Further, I see no reason to use GRC instead of the built-in password generator in KeePass (or some other locally run script). GRC doesn't even offer truly random passwords, so it literally does not provide you with any extra security.

You are basically giving up part of your security/password strength, without gaining any additional security. Not a very good idea.

qhoster

KeePass

24khost

Security through obscurity for me please.

sha1 hash of a md5 hash of a base64 encoded password.

Taz

Excel and google drive and password protecting file itself . Really happy to understand that, I will no longer have to log into multiple server every other hour. I AM FREE!

juan

This

Maounique

And I thought I was paranoid... I use passes like INeverForgetMyPasswords! If possible I add spaces.
I mean, WTF, if I have the government against me, a good pass/keyphrase/encryption etc will probably not help me much, they dont really need evidence. It is better not to put your life online than having to protect it with passwords.
M

24khost

password1 > base64 encode > md5 hash > sha1 + salt

24khost

forgot to add salt

Garrett

@24khost said: password1 > base64 encode > md5 hash > sha1 + salt

You should move base64 to the end so your password utilizes the full alphanumeric character set instead of just hexadecimal.

Buting58

I just save the email with the account info

Chan

"randomwordsiremember""website'sname""website'snamebackwards""randomsentenceiremember""yearregsitered"
so it'll be like
"applelettelhieveryonehowareyou2012"
That should be more than enough to put people off using brute force or dictionary based attacks....

craigb

@craigb said: For command line junkies, I recommend password-store....a thin wrapper around shell commands and gpg2: http://zx2c4.com/projects/password-store/

Hmm, how does it secure your stored passwords? It's not really clear to me from reading the page.

It uses a gpg key you provide when running 'pass init' to initialise new password storage. So either use an existing gpg key or create a new key using gpg2 --gen-key. The crypto algorithm used (RSA or DSA) and keysize is selected during key creation.

bdtech

@joepie91 You must be really fun at parties. I don't use keepass soley to generate, store, and secure my passwords because I'd rather not keep all my eggs in one basket. Have you reviewed the keepass source code? GRC does not have my password because I append my random string to a subset of their random and they don't know where/how I use my passwords. It sounds like your worried more about password security then the security of the front door at home.

littleguy

mRemoteNG!

Wintereise

I'm scared to admit that I use lastpass now <_<;

joepie91

@Zen said: And yet, it is often one of the most efficient methods of 'security'. And I'm not just talking about security in the IT world.

Source?

@craigb said: It uses a gpg key you provide when running 'pass init' to initialise new password storage. So either use an existing gpg key or create a new key using gpg2 --gen-key. The crypto algorithm used (RSA or DSA) and keysize is selected during key creation.

If you generate a GPG key with password, doesn't that mean you have to enter your master password every time you want to retrieve a password?

@bdtech said: You must be really fun at parties.

Really? Trying to ridicule me because I'm pointing out flaws in your security? Very mature...

@bdtech said: I don't use keepass soley to generate, store, and secure my passwords because I'd rather not keep all my eggs in one basket.

That makes no sense whatsoever.

@bdtech said: Have you reviewed the keepass source code?

I have, actually.

@bdtech said: GRC does not have my password because I append my random string to a subset of their random and they don't know where/how I use my passwords.

First you 'use GRC for a random string', then you 'use a subset of the random string from GRC', and now you suddenly append random stuff yourself? Which is it?

@bdtech said: It sounds like your worried more about password security then the security of the front door at home.

Considering I have very few physical objects of value, if any at all, and the data I protect using encryption is more valuable to me than that, that doesn't seem like such a strange approach. Not to mention that I'm not only responsible for my own security, but also for that of others. Something about being a developer and stuff.

tinyray

pass = providerName + planName

Raymii

@bdtech said: @joepie91 You must be really fun at parties.

Actually, he is quite fun to hang around with. And how nice of you to attack someone personally when a discussion is noit going in the direction you might want it to go.

@bdtech said: I don't use keepass soley to generate, store, and secure my passwords because I'd rather not keep all my eggs in one basket.

Keepass can export to text and xml, gpg / encrypt that file, done. Or, import it into lastpass.

@bdtech said: GRC does not have my password because I append my random string to a subset of their random and they don't know where/how I use my passwords.

@bdtech said: @joepie91 Like I said I pull a random subset of a string from GRC. Plenty secur

@bdtech said: I pull a random subset of a string from the GRC password tool and store it in keepass (password and key) in a dropbox folder.

So what is it? And it seems you use keepass to store and secure your passwords, maybe just not generate them.

@tinyray said: pass = providerName + planName

pass = echo "providername+planname" | shasum

Oliver

KeyPass for me.

head -c 1000 /dev/urandom | strings | perl -ne 's/\s+//g;print' | cut -c 8-48

:-)

serverbear

Google Spreadsheet with 2 factor authentication + Public/Private keypairs.

craigb

@craigb said: It uses a gpg key you provide when running 'pass init' to initialise new password storage. So either use an existing gpg key or create a new key using gpg2 --gen-key. The crypto algorithm used (RSA or DSA) and keysize is selected during key creation.

@joepie91 If you generate a GPG key with password, doesn't that mean you have to enter your master password every time you want to retrieve a password?

You can do it that way or run gpg-agent and have it cache your key password(s) for a configurable time. Different password stores can be created for different types of things (e.g. to separate banking from vps login). Docs here: http://www.gnupg.org/documentation/manuals/gnupg/Invoking-GPG_002dAGENT.html

hdpixel

I use evernote.com.

joepie91

@hdpixel said: I use evernote.com.

Why would you store unencrypted passwords for your servers on a third party service?

tweakstur

+1 for KeyPass.