Hacker News Reader

Comment by vbezhenar | Hacker News Reader

That's why my passwords in text file and I consider it fine. If someone breaks into my machine and I won't notice it, password will be keylogged anyway. The only true defense would be hardware-protected external password storage, but I'm not aware of any.

View on HN

People looking over your shoulders, you sending a screenshot where you forgot the open file in the background.

I agree a text file is 'secure' enough for you but a lot of password systems also hide the password in the UI which is a pro inho (I use KeePass).

How often do you send screenshots on the internet without looking at them before you send? I mean, I know if I screenshot a browser for example some nerd will comment on all my bookmarks other tabs etc (because if it's someone else posting the screenshot the nerd is me).

A file in a place not immediately obvious to a casual browser without obvious references to what it is seems broadly fine to me. (I don't bother, Instead just re-use passwords because I'm a horrible person)

Yubikey

Are you sure it can store passwords and decrypt them with required touch? What's its memory?

You can use a YubiKey for a portion of a master password. This is best used by manually typing "correct" and autocompleting the latter portion with plenty of entryop of the password/phrase "battery horse staple" from the key. This way, if someone steals the key, you've still got a secret.

You'll still need a password manager to store the unique passwords for your services.

https://www.yubico.com/support/knowledge-base/categories/art...

https://www.yubico.com/wp-content/uploads/2015/11/Yubico_Whi...

EDIT: Explanation

I think that advanced malware can intercept this master password and decrypt all data. I had in thought some hardware, which stores all passwords, reveals only metadata and to actually retrieve a single password, you have to physically interact with device (tap it, for example). In this case even if malware has full control over your PC, it can't retrieve all passwords, only those you've actually used.

Reply on news.ycombinator.com