Jason Donenfeld

Wireguard is written by Jason Donenfield, a renowned developer with deep crypto knowledge. You can search him up and see for yourself. https://www.zx2c4.com/

pass[1] is a pretty good choice. But you also have to make sure your provider really follows decent security practices. gandi.net is a pretty decent provider not full of BS (as their slogan states). [1]: http://zx2c4.com/projects/password-store/

Interesting. For storing passwords I use Pass[1] which encrypts everything with GPG and then store it using Git in a private bitbucket repo. Works really well for me. I love the simplicity and ease of use. [1]http://www.zx2c4.com/projects/password-store/

http://www.zx2c4.com/projects/password-store/ I started using it earlier today actually (moving from KeePassX and have been meaning to for a while) and so far I really like it. As an Emacs user the Emacs integration plugin is also pretty amazing and it has import functionality for most known password managers.

Lots of recommendations already, but I'll throw in a vote for Pass[0]. It's simple, cross-platform, and doesn't require trust in any service--although you do need to trust yourself not to lose your gnupg private key. [0] http://www.zx2c4.com/projects/password-store/

I'm a long-time user of pass (http://www.zx2c4.com/projects/password-store/). I prefer tools that integrate well with the command-line, but there's a few things I didn't like about pass, so I started my own password manager, called passman (https://github.com/manicolosi/passman). I wouldn't recommend using it yet, but any feedback would be super helpful.

What's the consensus here? http://zx2c4.com or http://www.zx2c4.com ? For a while I did the latter, then I switched to the former, and now I can't make up my mind and am tempted to go back to the latter. Opinions? Thoughts?

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use. Until I came across this: http://www.zx2c4.com/projects/password-store/ It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to come into existence. I am not associated with the project, but these are just a few things I love about "pass" 1. Command-line based: which means I can script it, I can run it remotely, etc. 2. Uses Git to store the passwords: full revision history, changelog, and remote push/sync features that git is SO good at. Other password managers have to reinvent that whole wheel and none seems to do a good job. This also eliminates the need for "hosted" solutions - which I just simply refuse to use. 3. GPG for password encryption: once again, such a natural, awesome way to do things. GPG is already the safest way practical way to secure data-at-rest. I can rest easy that no silly homegrown encryption system was invented. Also, as long as I have the keys, in the worst case I can do the decryption myself, if I do not have access to "pass". The only thing I believe it might lack is the fact that the names of the entries are in the clear. Which means I cannot setup a github(private) repository as remote for my pass store: the passwords themselves would still be gpg…

OP is likely referring to http://www.zx2c4.com/projects/password-store/

Firefox's password manager for web stuff, system keyring (whatever comes with Ubuntu) for passwords to GPG and SSH keys, and pass[1] for everything else. [1] http://www.zx2c4.com/projects/password-store/

Nothing too crazy. I have a keyboard shortcut that grabs the URL from chrome, then passes it off to a script that interfaces with pass [0] to have a rudimentary, but secure and cross platform password manager. [0]: http://www.zx2c4.com/projects/password-store/

I also like KeePassX but its major flaw is not being able to sync or merge databases. That has led me to consider using password-store[1]. Has anyone found a way to overcome the sync problem with KeePassX? 1. http://www.zx2c4.com/projects/password-store/

I've been using http://www.zx2c4.com/projects/password-store/ which handles that by integrating with Git, encrypted passwords are stored in a Git repo and all changes are recorded as Git commits. It's no more difficult than using a centralized third-party service, provided you have somewhere to host a Git server for it.

I use pass http://www.zx2c4.com/projects/password-store/ You could store your passwords in a git repo to get a sort cross-platform thing going on.

Use pass[1] if you want to use the command line, it uses GPG to encrypt each password and git to version them. It's pretty nifty. [1]: http://www.zx2c4.com/projects/password-store/

I used to use 1Password, but I've switched to pass[0]. I prefer it because it's written for the command line and works really well. Your passwords are encrypted with your GPG key. Check out the man page for usage and examples[1]. (It's available on Fedora via yum and on OS X via brew and there's also an iOS app). [0]: http://www.zx2c4.com/projects/password-store/ [1]: http://git.zx2c4.com/password-store/about/

I had 13 login attempts from South America, Asia and Middle East. My login details have been leaked in several leaks, latest being the Adobe leak. And even though I've had strong password, my fault's been that I've used the same password in lots of places. Luckily the Adobe leak was the final straw and I finally started to use a good password manager and super strong, distinct passwords in all the services I'm using. It wasn't that bad at all, just selecting a good password manager[1], strong encryption and an easy way to sync your passwords between devices (git), I've had no trouble at all with strong passwords. Although it would be nice to have an Android app for the password manager. I think it's a nice excersize for writing my first Android app at some point... [1] http://zx2c4.com/projects/password-store/

No decent password manager will expose your passwords to a third party. If syncing is supported, only passwords encrypted with your master password are sent over the network. AFAIK, that's how all the popular ones work. FWIW, I use "pass", which is a short bash script that's a thin wrapper around gpg. If you can't trust that, I'm not sure how you can use a computer. http://zx2c4.com/projects/password-store/ Btw, your password square generator isn't using a secure source of random numbers, which makes me highly doubtful.

I'm a huge fan of this command-line password manager: http://zx2c4.com/projects/password-store/ It's just a simple wrapper around gpg and (optionally) git. Makes it real easy to sync passwords between machines and you can be as confident as possible about the security.

I hadn't heard of Lastpass Enterprise or Meldium before. At previous companies I've used Passpack (http://www.passpack.com/en/home/) but didn't really like it. The sharing model is a real pain and doesn't scale. Team members create passwords in their individual accounts, then transfer ownership to a company account. Now the person who administers the company account gets an email, logs in, accepts the transfer, and shares the password to the appropriate team members. Now that I'm in a simpler environment where veryone has access to all the passwords, I just use pass (http://zx2c4.com/projects/password-store/) and a central git repository.

For a nice gpg-encrypted password store, see "pass": http://zx2c4.com/projects/password-store/ Many programs that require passwords (e.g., mutt, offlineimap, msmtp) let you specify a command to retrieve the password, which is really easy using pass.

hannob aptly explained why I left my job, because Quantum RNG is a gimmick and doesn't solve any real problems. But to expand on that, it was heavily marketed with the idea that somehow we're living in a "entropy starved" world. We do a pretty good job of gathering entropy today from various sources such as mixing unique identifiers of hardware, CPU jitter, interrupt timing, RDRAND (which is a similar design to metastability of ring oscillators), etc. So the remark if you haven't managed to generate one secure 256-bit key then you have much bigger problems resonated heavily with me, and I realised there just isn't a need for gigabit speed TRNGs and the Quantum marketing is just scare tactics which my employer employed. Also no crypto library or application is going to modify its entropy source to get its randomness from a TRNG device directly when it already has access to a high quality RNG via OS APIs/crypto libraries (for a good list of these check out https://randombytes.cr.yp.to/). The concern I would have with relying too much on a source key to derive other keys from would be if one of the keys is leaked, the others would also be exposed A modern RNG would implement fast key erasure which is what Jason Donenfeld did with random device in Linux. See https://blog.cr.yp.to/20170723-random.html and https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-linux-kernel… .

i can't really use this project now that my main os is osx(i frequently boot from my ssd with archlinux on the mba), but i absolutely love this project. it's amazing, the only thing i'm a little sad about is that i never wrote the pass plugin i wanted for password store [1]. but hey you can still write one the main author moved, but there are fairly active forks[2]. the amazing thing about this is that you can write plugins in any scripting language you want. you can pretty much hook it's basically a mighty scriptable version of webkit. here are a bunch of scripts you can use to extend it with [3] on a sidenote, a completely different, but also interesting approach are conkeror [4] and luakit [5]. though luakit seems abandoned too. luakit is kind of a lua webkit browser framework with sane vi like defaults. conkeror is an emacs for xulrunner, however keep in mind that since firefox is taking over the role of xulrunner you might not really need xulrunner at all. [1] http://www.zx2c4.com/projects/password-store/ [2] https://github.com/mathstuf/uzbl/tree/next [3] http://www.uzbl.org/wiki/scripts [4] http://conkeror.org/#Installation_and_Startup [5] http://mason-larobina.github.io/luakit/