Hacker News Reader

Comment by 0xfeba | Hacker News Reader

Cloud managed (but still pretty damn secure): LastPass or 1Password

You manage security: KeePass

I use KeePass with a keyfile and password. The DB is stored and sync'd across devices in DropBox, I have my DB and key regularly backed up on a USB drive. The key is also present on some machines that I cannot easily add the USB to (eg. phone). It's the only password I need to remember -- I have literally hundreds (400+) of accounts. I do not regret it at all -- but it was a huge pain to migrate everything to it.

I also store my Google authenticator initial QR codes on it, in PNG format.

View on HN

1Password doesn't have to be "cloud managed" the way LastPass (ick) is. You can do pretty much everything in 1Password native clientside, and that's what you should do. 1Password is basically the gold standard for commercial password managers, and I think probably the only commercial password manager you should consider.

Thoughts on syncing 1Password database via Dropbox? I have multiple machines and that's what I do, but it worries me. Haven't found a more elegant solution though.

I use home-brew script with rsync to syncronize. I don't dropbox on critical machines.

KeePass can also generate TOTP codes. Kind of ruins the point of these codes, but if you're already storing the QR codes on it, you can go a step further and just get KeePass to generate the output code for you.

https://bitbucket.org/devinmartin/keeotp/wiki/Home

If you wish to retain the "two factor" aspect, you can put your 2FA codes in a separate keepass database. You do lose the "two separate devices" bit of extra security (your threat is now keepass-aware malware or keyloggers with filesystem access), but if your one db is compromised the 2fa codes are not (and vice versa).

However, storing 2fa codes alongside your password is still more secure than not. If the service password is compromised without the 2fa seed (main threats: MITM, phishing), the one-time password prevents the account from being immediately compromised.

"One of these days" I'm going to get a safe and print them off and remove them digitally.

Reply on news.ycombinator.com