Password managers

nunotex

nunotex

Hello all,

I'm looking for password manager solutions that works with major browsers (chromium, firefox).
I will work with both browsers on several machines on amd64 and aarch64.

Both browsers internal password managers work great but I'm looking for a wide solution with better control of passwords database.

security/gopass + browser plugin seems to be a good solution.

Any thoughts or better solutions?

Thanks
 
security/keepassxc works fine for me and has the advantage that the password vault is stored on your own device instead of somewhere on the cloud waiting for hackers to break into it.

The KeePassXC-Browser extension for Firefox works fine but I've never managed to get the Chromium extension to work so need to copy and paste info from the keepassxc window on the rare occasions I use Chromium.

I have the Keepass2Android Offline app on my phone and tablet which works fine with the password database file copied from my PC
 
rawthey said:
so need to copy and paste info from the keepassxc window on the rare occasions I use Chromium.
Click to expand...
Use the auto-type functionality of Keepass. CTRL-ALT-A and it'll fill in automagically.

Keepass it is for me. Both on Windows and FreeBSD. Password database can be shared between the two.
 
rawthey said:
Autotype is a feature I hadn't previously explored
Click to expand...
It's the primary feature that made me use Keepass :)

That said, it heavily relies on window titles. And this can be a bit of a hassle with browsers. Especially if you have multiple tabs open.
 
Crivens said:
A little black book and a pen?
Click to expand...
I’d only do that for select passwords, such as the master password of a password database (in case of password fatigue). 300+ passwords in a book (cryptographically weak or not even encrypted at all) is a security nightmare. I mean, I hope you do follow the best practice and do not reuse passwords, right?​
nunotex said:
Any thoughts or better solutions?
Click to expand...
Yeah, at the risk of sounding unhelpful, but do not use passwords. There is the GSSAPI. At my alma mater I could obtain a Kerberos ticket (automatically done at login time) and access all access-restricted staff websites without additional authentication (by that I mean additional user interaction).

Now, I know you can’t demand such seamless integration – this very forum only allows password-based authentication, too – but in principle the idea of sending passwords to a remote webserver can be deemed an anachronism.​
rawthey said:
security/keepassxc works fine for me and has the advantage that the password vault is stored on your own device […]
Click to expand...
Does it provide a TUI (text user interface)? Ten+ years ago I chose security/yapet simply because of its intuitive ncurses-based TUI. In my opinion such a crucial tool should not depend on running X11, you know.​
 
I've been using sysutils/password-store for over 5 years now - its basically only shellscripts using standard tools (gpg and git), so no lock-in to a 'custom' binary format or database, its just a git-repo with gpg-encrypted text files. it's also easily understandable and extensible if none of the available plug-ins fits some special use-case.
browser-plugins for firefox and chrome are also available.

If you don't like a fast&simple cli approach, there are also a qt and rofi frontends available: sysutils/qtpass sysutils/rofi-pass
 
Crivens said:
A little black book and a pen?
Click to expand...
Or a script with

openssl aes-256-cbc -e -a -salt -md md5 -in $1

for encrypting a file and and other with

openssl aes-256-cbc -d -a -salt -md md5 -in $1

for decrypting. Would be that an idea?

Perhaps the file built so, that one gets the required pass with grep.

UPDATE: correction in flag for decrypting.
 
Last edited:
As recent happenings with Bitcoin wallets have shown, good crypto is hard to do. You have to trust the implementation that the keyspace is not limited to a brute force able range. With a little black book, you need to obtain physical possession of the thing and be undetected. This is much harder these days as lifting your passwords using a bad browser plugin.
 
Crivens said:
With a little black book, you need to obtain physical possession of the thing and be undetected.
Click to expand...
Yes, but you cannot do copy and paste, and it is hence unpractical for long passwords that you need
to defend from brute force attacks.

Keeping the password list on your computer is only a problem when someone gets access to your computer.
A little encryption is in any case not bad.
 
hruodr said:
Or a script with

openssl aes-256-cbc -d -a -salt -md md5 -in $1

for encrypting a file and and other with

openssl aes-256-cbc -d -a -salt -md md5 -in $1

for decrypting.
Click to expand...
The two openssl commands posted are exactly the same. Copy-and-paste error? I'm guessing that one or the other must be different?
 
fraxamo said:
The two openssl commands posted are exactly the same. Copy-and-paste error? I'm guessing that one or the other must be different?
Click to expand...
Yes, a lapsus. For encoding:

openssl aes-256-cbc -e -a -salt -md md5 -in $1

for decoding:

openssl aes-256-cbc -d -a -salt -md md5 -in $1

Do

man openssl-enc
 
hruodr said:
Yes, a lapsus. For encoding:

openssl aes-256-cbc -e -a -salt -md md5 -in $1

for decoding:

openssl aes-256-cbc -d -a -salt -md md5 -in $1

Do

man openssl-enc
Click to expand...
If you're going to go cli for it, could checkout password-store. It's a script wrapping pgp and git. If you wanna drop the app all your passwords are stored in plaintext files that are encrypted with your pgp key. I know there is an Android app for it too and since you're pulling from your personally defined git repo you can keep as close to the vest while being able to sync your passwords between boxes and mobile.

Its in the ports tree too
 
hruodr said:
Or a script with

openssl aes-256-cbc -e -a -salt -md md5 -in $1

for encrypting a file and and other with

openssl aes-256-cbc -d -a -salt -md md5 -in $1

for decrypting. Would be that an idea?

Perhaps the file built so, that one gets the required pass with grep.

UPDATE: correction in flag for decrypting.
Click to expand...
Just use vim -x .
 
hruodr said:
For what I would need that?
Click to expand...

I was just suggesting if one is going the cli route there are simple sane tools for doing this type of solution. I went the openssl cli route for a few years but now I have my passwords sync between two desktops and my phone using self hosted git server and a pgp key that is in no way public.
 
jecxjo said:
I was just suggesting if one is going the cli route there are simple sane tools for doing this type of solution. I went the openssl cli route for a few years but now I have my passwords sync between two desktops and my phone using self hosted git server and a pgp key that is in no way public.
Click to expand...
same here - I used the switch to a yubikey (used as smartcard for GPG keys) as an excuse to also switch to password-store (tried e.g. keepass before, but they are all a bit restrictive and clunky and in no way accessible if there's e.g. a bug). SSH logins, email signing/encrypting and passwords (and other) encryption is since done with the keys on the yubikey, which needs its own password for unlocking (the only one I can and have to remember by now...). The git repository for pass is synced to several servers and my desktops and laptops and backed up to tarsnap.
Thanks to password-store only being encrypted text files you can store absolutely anything in it - from addresses or SSH/GPG keys, tax data or even base64 encoded images/scans, anything that might be presentable as text. Other solutions often restrict you to a few pre-defined fields, but this is a true unix solution using basic tools, hence it can be used very universally.
 
Resuming we have:

security/keepassxc + KeePassXC-Browser add-on
security/gopass + Gopass Bridge add-on

Anyone using gopass?
 
You must log in or register to reply here.
Back
Top