

Nobody Knows My Password; Not Even Me - Brewer
http://jamesbrewer.me/nobody-knows-my-password-not-even-me

======
inportb
> Of course, there are still things that I need to remember my passwords for.
> For example, anything I connect to via a terminal I have to be able to
> remember the password for because you can't paste to a terminal (at least
> not that I know of, if you can then someone please tell me!)

I'm not sure what OS you use, but many terminal programs on Linux (and at
least one on Windows) allow you to paste by right-clicking or middle-clicking.
Or by pressing ctrl-shift-v, but I find that slightly awkward.

~~~
Brewer
I'm using Ubuntu, I'm just a total noob that thought since Ctrl-C and Ctrl-V
didn't work that all hope was lost. Clearly I was wrong.

~~~
inportb
Alternatively, I believe you could right-click the terminal to make copypasta
via the context menu.

~~~
wollw
Or use control+shift+c and control+shift+v in many terminal emulators.

Edit: Seems I overlooked this being mentioned above. Oops.

------
qixxiq
I've been using a similar scheme but without a database. Just a bcrypt hash of
my password using the website/systems name as a salt, and then formatted
according to an alphanumeric alphabet with symbols.

It also has support for sub passwords (such as "work/twitter") where it simply
generates the "work" password and uses that to generate the twitter password.
That way I can give the work password to anyone who needs it and they can get
into twitter/etc, while not needing to remember it myself.

This is useful because I can upload the password generator to a website, along
with keeping copies on my phone and pc.

I'd be interested in knowing the cryptographic security of this scheme, but
I'd assume its pretty good.

~~~
drdaeman
This gets problematic when you encounter a site which dislikes your generated
password. It just tells that the password is either too long or complex ("N
chars max or can't contain '/' character"), or too short or simple ("must
contain numbers", and this exact generated one didn't).

Handling such exceptions is somehow unpleasant.

------
mikelbring
But you can see your password if you paste it into a non password field? So
you really could know it if you wanted to. I still see the benefit I guess
because of the reasons you mentions.

~~~
Brewer
Yes, if I wanted to know what my password is then I could paste it into
Notepad and write it down on a piece of paper. I just choose not to.

~~~
pacaro
And potentially malware can watch the clipboard and "paste" things to L.Ron
Hubbard knows where, it's not only your roomies that might be looking over
your shoulder...

~~~
hwiechers
But even if you're typing your password in, malware could just log your keys.
If malware is on your box, the game is over.

------
zacharycohn
So... what happens when your database gets corrupted/your hard drive
fails/laptop gets stolen? How are you going to connect to all of your
everythings?

Alternatively, what happens when you want to transition away from KeepassX and
to another, better, more advanced password manager? Or away from password
managers all together?

There are so many meta-problems to deal with when using password managers, I
think in the long run they might be more trouble than they're worth.

~~~
dspillett
As aw3c2 points out, backups and export options can resolve two of the issues
you cite.

As for "if your database gets stolen", that is covered by the encryption of
the data and the login method: a password that you know (this one you would
have to remember, obviously) and a key file (this may or may not (probably
not) be counted as two-factor authentication, depending on how you manage the
key file). The thief would not be able to open the database to find your
credentials.

If the credentials store and the credentials required to access it are both
compromised, so someone does have access to all the data stored within, then
you have the problem of changing all those credentials before anyone malicious
does something with them. With a backup of the database you have a convenient
list of everything that needs to be changed so you don't forgot something
important (though anyone else with access to the compromised data also has
this list...).

While having a central key store creates its own problems if it itself is not
secure, I think that little extra risk is small compared to the risk from
other password management (using easy-to-remember things that are thus
probably easy to guess, and/or even worse: using the same credentials for many
uses). The risk of compromised password store is a local issue, so is
something you can control (and hopefully mitigate) locally - no one can try
brute force my keepass DB remotely unless they somehow get hold of a copy
(which is possible I suppose, but not easy and would require them to be
specifically looking for _my_ credentials rather than a more general hacking
attempt), but they could try brute force any of my many online accounts or
just hack a poorly coded online application and read badly protected
credentials.

Bad password managers (or good ones badly used) are a problem as you describe,
but if used right a good credentials store with unique random long passwords
for every service/account is (IMO) better than any other suggested solution
I've come across.

------
staunch
The people that run the sites you use could easily know your passwords. Even
if they do store them hashed they may see them in POST debugging logs or
something.

------
mattlong
It almost goes without saying, but one of the biggest benefits in my opinion
is that you get to have a different strong password for each set of
credentials. Thus, god forbid, if some site you have an account with doesn't
encrypt your password in their DB and gets hacked, you don't have to worry
about changing all your other logins.

------
dfischer
I wrote a similar article to this and I highly recommend not using anything
without multifactor authentication in place.
[http://blog.danielfischer.com/2011/05/12/its-time-to-
start-u...](http://blog.danielfischer.com/2011/05/12/its-time-to-start-using-
a-password-manager/)

------
tpr1m
Welcome to password management programs? Keepass was released in 2003.

------
ddelphin
I think there should be a program like this that sync to mobile devices so you
ddon't have to have your primary device with you to be able to use your
accounts.

~~~
fbuilesv
There is, it's called 1Password :)

------
piramida
nice to see more people discover password managers, definitely a newsworthy
item. wait...

------
u48998
Before you use a password which is 9,999 in length, make sure the site you're
providing this password is even compatible beyond 8 characters. There are
password field boxes out there which would fool you by taking your long
password until you realize later that they only took 8 to begin with.

~~~
piramida
run away from such sites as they obviously store your password in a database.
there should be no difference which length is the password since database only
stores constant length salted hash of it.

