Password Managers - Your Expereience?

underachieved said:

But there was a discussion here about the future of encryption with the advent of quantum computing and passwords..

Click to expand...

Don't worry about it. While there's Shor's algorithm for quantum-based prime factorization, you should take the following into account:

• There's no non-trivial quantum computer in sight.
• Scaling Shor's algorithm to practical implementation is a very bad beast to tame.
• There exists quantum-proof crypto algorithms. When and if the 2 factors above get mitigated, it's as simple as downloading an update of your password manager software.

SirLouen said:

After being hacked several times for using the same passwords in all the sites, I'm starting to switch to a password that I can remember + that has my own "algorithm" built in and it's easy to decipher for me.

For example, this can be as simple as, using a little complex password like a combination of two of three elements you might remember. Then you count the letters in the domain (blackhatworld, 13) and you multiply by a number you like (for example 3)

Then the result is your "complex password" + 39
There are obviously more options that can provide more uniqueness, this is just something that I have made up for the example.

But the important thing is that ultimately you might have an unique or nearly unique password for each site you login and you don't have to save it anywhere, just in your brain.

Click to expand...

Do this too.

My setup is:

• KeePass for the actual password manager: https://keepass.info (+ clients for other OS/devices).
• A zero-knowledge cloud for automated backups of the database + key from a single machine.
• Pen and paper off-site backup for the access to the zero-knowledge cloud.

i always use this because it's the best way i know of to keep my passwords safe!

I use Dashlane for managing my pw. I'm too cheap to buy the premium version so it's a bit of a pain syncing all my passwords across multiple devices (you get that with the paid for version).

jazzc said:

There exists quantum-proof crypto algorithms.

Click to expand...

The main issue with quantum cryptography (and cryptography in general) is that mathematical models are purely theoretical -- and not practically-minded. While yes, brute-forcing a decryption key for a quantum encryption is fucking madenningly retarded, the majority of cryptographic exploitation is done with other, more sane methods.

For instance,

1. Side-Channel: Your encryption is only as secure as the machine that encrypts it. Exploiting (such as monitoring certain systems like the CPU cache) the parent system is a much simpler, easier, and more practically available method than brute-force. CPU cache, and other monitoring systems, are more "state actor" type shit, but simply having a compromised system (root/admin access by someone else) will make the private key completely available to anyone that has that access.
   
2. Pre-Computed Rainbow Tables: Compute all decryption keys once, and reuse forever. Simple, quick, efficient, but for quantum yes it's not that practical.
3. Backdoors: NSA/etc. intentionally sabotaging random number generators that narrow down the search space. Worse, if the software unintentionally implements a bad/broken cryptographic process (you're fucked)

Just a few, but there's much more. Elliptic curves (one "quantum" crypto) are the bees fucking knees though, and they should be used everywhere where maximum performance is not a concern.

In other words, use a strong crypto, but it's not your main concern. Making sure your software and hardware are on point is the real issue (because they're fuck all easily compromisable).

More on-topic: I use KeepassXC. It works on every system I use (Windows, OpenBSD, Linux, and yes even Android). GUI is really user-friendly with a lot of customizable database options. Exporting/importing is easy as hell -- it's just a kdbx file. So I can store it on my phone or even some cloud platform and be gucci.

I use it for all my important shit. Great for identity-management too, and it has notes so you can keep everything centralized. Hell, I even have all my personal documents (SSN, ID images, etc.) stored in that shit just in-case.

I use LastPass

Now my password management is more accountable.

I'm Super Smart and Remember ALL my Passwords (Secured in Brain)

Click to expand...

I made my own password pattern, so I can easily remember all of them. Moreover, I always use 2FA where possible.