The Only Password Manager I Can Trust

I have been using the standard Unix password manager (pass) for a few years and I really love it. It's simple to use and has a ton of extensions and third-party scripts that can be used with it. Pass can be used with dmenu, rofi, Xmonad prompts, Firefox, Chrome, Android and iOS devices.
REFERENCED:
► www.passwordstore.org/ - Pass
WANT TO SUPPORT THE CHANNEL?
💰 Patreon: / distrotube
💳 Paypal: www.paypal.com/cgi-bin/webscr...
🛍️ Amazon: amzn.to/2RotFFi
👕 Teespring: teespring.com/stores/distrotube
DONATE CRYPTO:
💰 Bitcoin: 1Mp6ebz5bNcjNFW7XWHVht36SkiLoxPKoX
🐶 Dogecoin: D5fpRD1JRoBFPDXSBocRTp8W9uKzfwLFAu
📕 LBC: bMfA2c3zmcLxPCpyPcrykLvMhZ7A5mQuhJ
SOCIAL PLATFORMS:
🗨️ Mastodon: distrotoot.com/@derek
👫 Reddit: / distrotube
📽️ LBRY/Odysee: odysee.com/$/invite/@DistroTu...
DT ON THE WEB:
🕸️ Website: distrotube.com/
🐿️ Gemini Capsule: gemini://distro.tube
📁 GitLab: gitlab.com/dwt1
FREE AND OPEN SOURCE SOFTWARE THAT I USE:
🌐 Brave Browser - brave.com/dis872
📽️ Open Broadcaster Software: obsproject.com/
🎬 Kdenlive: kdenlive.org
🎨 GIMP: www.gimp.org/
🎵 Audacity: www.audacityteam.org/
💻 VirtualBox: www.virtualbox.org/
🗒️ Doom Emacs: github.com/hlissner/doom-emacs
Your support is very much appreciated. Thanks, guys!

[@MarcCastellsBallesta]

Store all passwords in a text file. Then make text font color match background color. Ultimate hacker tactics. LOL!

[@priyapepsi]

le CTRL A + CTRL + C has arrived

[@MarcCastellsBallesta]

@@priyapepsi Oh! You hacked my unhackable password storage! 😂 😂 #Respect

[@priyapepsi]

@@MarcCastellsBallesta l33t h4xx0r skillz bro

[@Layput]

Doesn't work. I have to keep 300+ strong passwords.

[@chigozie123]

Remember guys, the goal is not to protect the key, but to protect what that key can unlock. If you spend too much effort guarding the key, but forget to lock the door, your efforts are as effective as building a sand castle to withstand the ocean waves. Your choice of password manager should be secondary to where you put your valuables. The internet is often not the best place to store your nudes or your credit card pin, and a password manager ia really just a glorified key chain. That is all.

[@JermaineOneal1]

Damn he knew the future about LastPass....

[@addygreen8919]

If nobody else can easily enter the room or look inside the room where your computer is, it is not that bad to put a note next to the computer.

[@oberlinio]

Class bad practice, but with remote working now, doesn't seem so bad. As long as your kids aren't trying to access

[@oberlinio]

Classic*

[@addygreen8919]

@@oberlinio Not really a bad practice, if you do it the right way (nobody else you do not trust can easily enter the room or take a look at the note from outside). Or you could also lock the note with the passwords in a save. Most people do not encrypt there system. So somebody with physical access could already get most of the data. So preventing physical access is the most important thing. It is also way better than trusting some cloud service with your passwords.

[@XxDarkXxXSasuxX]

@@addygreen8919 Yes it is. The answer to physical access as a security flaw is not to make it easier. If it is just as easy to extract passwords from an unencrypted computer, the solution is to encrypt the password storage, not make it easier by just sticking the password under your keyboard lmao

[@addygreen8919]

@@XxDarkXxXSasuxX If physical access to the room with your PC is not that easy, it is way more secure to place the note with your passwords under the keyboard, then what a lot of other people are doing: Using some shady cloud password manager. It is also not like that you need to put the note with your passwords directly near to your PC. About secure and open source password managers: I am pretty sure that there will be a lot of people, who get problems in some years, when their password management software does not work anymore for some reason. Maybe the user accidentally deletes some stuff or the software does not work with upgraded packages. A lot of this people won't be able to deal with this problems by them self and it would have been way better for them, if they would have just wrote their passwords with a pen on some paper.

[@paarthjuneja3707]

Hi DT! This video in the new office looks great!

[@NaurisMich]

Very useful information! Thanks!

[@WatchingBlue]

Also one downside is that you have to backup the password files and the gpg key (could bei done by using paperkey). Other programms just encrypt your data with a master password. But i would agree that pass fits the GNU/Linux philosophy perfectly.

[@baran6186]

Office looks great!

[@Rundik]

Keepass is a lot more convenient for me. And it doesn't show services that you use which is kind of important if you're storing them in some cloud storage

[@1MinuteFlipDoc]

KeepassXC!! Why KeePassXC instead of KeePassX? KeePassX is an amazing password manager, but hasn't seen much active development for quite a while. Many good pull requests were never merged and the original project is missing some features which users can expect from a modern password manager. Hence, we decided to fork KeePassX to continue its development and provide you with everything you love about KeePassX plus many new features and bugfixes. Why KeePassXC instead of KeePass? KeePass is a very proven and feature-rich password manager and there is nothing fundamentally wrong with it. However, it is written in C# and therefore requires Microsoft's .NET platform. On systems other than Windows, you can run KeePass using the Mono runtime libraries, but you won't get the native look and feel which you are used to. KeePassXC, on the other hand, is developed in C++ and runs natively on all platforms giving you the best-possible platform integration.

[@Rundik]

@@1MinuteFlipDoc I'm actually using KeepassXC. It's not like it's really good, but it's the best client for keepass for now. I hope there will be something better looking and more stable in the future

[@holleey]

@@Rundik I don't see how it leaves anything to be desired in terms of looks or stability. I would be happy to see a couple more features though - for example deeper configuration options for backups.

[@hammerheadcorvette4]

@@holleey Deeper configuration options for KeePassXC ? Like? It has everything you need.

[@holleey]

@@hammerheadcorvette4 currently, all I am aware of is one toggle option "backup database file before saving". this creates one copy of the database file sitting in the same folder as the original. this is the most barebones implementation of backups possible and leaves much to be desired. specify a custom filename pattern and location for the backup. specify multiple backup locations. then if we go more advanced, upload the backup to a server. automatically mount an external drive to backup to. have different triggers for backing up, not just on saving the file. ... so you either have very barebones requirements for backups personally, or I am not aware of some obscure options.

[@vaultdweller966]

Enpass with Dropbox sync. Compatible with all my devices and easy to use.

[@IvicaAnteski]

In fact, writing you password on a piece of paper is most secure way to store it 😃

[@ricomajestic]

And hiding that!

[@matman1975]

If you use a web browser to remember your passwords and user names, you should always create a primary or master password file. Otherwise anybody can just find and view the passwords from the password section of the web browser. It can be a pain as the browser will prompt you for your master or primary password when browser starts up.

[@anon1div0]

My method is Bitwarden (self hosted) in Docker + 2FA + Yubikey . pgp keys etc are encrypted in Cryptomator in various cloud drives and synchronised to all my computers & NASs via Syncthing. Multiple encrypted backups of all important data and passwords everywhere. A paper printout of passwords is also kept in a secure safe off site. PC and NAS access is via 2FA yubikeys. I can survive a world war , power cuts or having all my equipment stolen; and still have access to all my passwords.

[@jocadbz]

Pass is really amazing. Although I use Bitwarden

[@RoryIsNotACabbage]

For real tho. Straight up pen and paper is as secure as your house is and that's nothing to scoff at If you're worried about friends accessing it you maybe need to rethink who your friends are, but in these times that's less of an issue

[@vaultdweller966]

Sure... Manually typing 30 random characters passwords multiple times a day is so fun! Oh and that's a known fact that friends NEVER betray you. That never happens.

[@obamascock2169]

@@vaultdweller966 Most websites have indefinite sessions so no clue what you are talking about maybe i might have to type in a password once or twice every day at most

[@Jordan-hz1wr]

Fast forward to 2023 and LastPass has indeed been pwn’d 😂

[@jons2447]

"Thank you!", DT! I was doing it wrong! Now I know better (still doing it wrong but I'm working on it). Have a GREAT day, Neighbor!

[@gamerboy4566]

Never used pass before. Will give it a try. Please also review Buttercup password manager.

[@scottmeijer2870]

Perhaps I have too many apps, but I enter passwords on my phone using my password manager all the time - usually right after installing a new app, after that I switch to fingerprint if available.

[@slalomsk8er397]

a keepass db for me. a paper notepad is perfectly secure against online attacks and you have some physical protection of your home as well - it's perfect for patents and grandparents.

[@FraYoshi]

unless they press the "save password" button on the browser XD

[@zonnodon163]

Nah, nothing beats writing it down in a blank notepad/book. Also cloud based password managers aren't a great idea, security wise. Offline password managers are much preferred.

[@fightlikabrave]

Until the notebook is found by someone beside you... use a "double blind" method with PW manager ie ADD an extra memorized "PIN" to all the long complex auto generated PWS your manager makes. Then even if the manager gets hacked and decrypted, your PWs saved within are all incomplete anyways only YOU know the extra "PIN".. And yea you could use this method with a note book too, to be fair lol

[@jandre281]

@@fightlikabrave This shit is genius, never thought of it. Even if its an simple addition like a single letter, noone knows

[@SoulOctavius]

@@fightlikabrave Yea I'm gonna add a symbol instead.

[@MoopyToopy]

I use this all the time. Works great with rofi-pass. Recently set up the recommended android client. Works nice. The one thing I got annoyed with was having to re-enter my gpg passphrase every so often (also not safe against keyloggers?). What I have now is a gpg key without a passphrase which is stored on an encrypted usb drive. The usb drive is attached to my keychain and the idea is that while the keys are plugged in and the drive decrypted. I can use pass freely without the passphrase prompt. Pull the keys out and suddenly all my passwords are secured again.

[@larsnordstrom364]

I like that, clever solution.

[@danilodistefanis5990]

But you have to encrypt before pulling the Keys.

[@MoopyToopy]

​@@danilodistefanis5990 I don't think decrypting the keys changes anything on the actual storage device that you have to 're-encrypt' when you want to unmount. wiki.archlinux.org/title/Dm-crypt/Device_encryption#Cryptsetup_usage is how I've encrypted it with luks encryption and I'm fairly confident that even if you pull out the drive after decrypting, everything is still encrypted when you plug it back in.

[@duser]

Huh I never heard about this. What are your thoughts on Keepass? And KeepassXC? It basically does the same thing as pass but it's not CLI. I don't know more of its advanced features but I found keyring support, something about ssh and some other stuff.

[@pureheroin9902]

thats what i use. its fantastic

[@azrela8277]

I’ve been running KeePassXC for a while now. Working great for me. Good project, and cross platform for those who need such features.

[@duser]

Thanks everyone here! nobody talks about keepass online. Its always laspass for the normal consumers and bitwarden for those that know a bit more. I like keepass's local assword database better than both those solutions.

[@YuraJayRJay]

Can pass automatically fill in the password if URL of the website matches the saved template? Also can you save a set of URLs/domains associated with one login/password pair? This way when the account's password changes, it'll affect all websites that use this account (e.g. Microsoft account, MS Exchange account, other corporate/ecosystem accounts). Bitwarden offers these features and they really make a difference. My only gripe about Bitwarden client apps is that they aren't as fast as other services/apps I'm used to (Telegram, Aegis, Syncthing...).

[@lemurza5236]

You can use git to sync your passwords with Pass

[@Ether_Void]

In theory pass is quite nice ... but I don't like the implementation at all. Having a separate file for each password can actually be quite dangerous in itself. And GnuPG is still stuck with SHA-1 for key derivation per default which is just a horrible decision. Since the main concern for GPG is mail encryption (PGP) is also doesn't support any newer more KDF functions (like pbkdf, scrypt, argon2) as they aren't part of the standard.

[@linuxinside6188]

Useful

[@alistair1840]

I have been using the Brave web browser, does Pass work with that ?

[@FedericoYulita]

How do you get your passwords if you’re on another machine like, say, your phone? Wouldn’t it be easier to just self-host your own Bitwarden server? I don’t see the point

[@Wool314]

Syncthing is an incredible general utility for syncing files. (No hosting required) But any other synching method is nice Difference with bitwarden is ease of extensibility But to each tgeir own, peoples usecases and preferences differ

[@stormfart9409]

there are pass compatible clients people have made that work for ios, as well as one android client. for some reason there is more choice on the ios side.

[@MassimilianoAdamo1967]

I wonder what is the application that you use for you prompt.

[@ellandill]

Copying password to the clipboard could be quite dangerous actually. Any app can read it. Yet regarding cloud providers - compromising is not a big isssue if e-2-e encryption is implemented - the only cocnern I've is how browser plugin sandbox is secure

[@coop4422]

Your solution in ok when you are at your computer at home. But I also need my passwords with at work or not at home. What do you do for that?

[@StrikerEureka85]

lastpass has been breached before, more than once

[@vitastimator]

Left Lastpass for Bitwarden. Lastpass restricts now access from one device only free plan.

[@StrikerEureka85]

@@vitastimator yeah i use bw as well

[@nilen]

@@vitastimator yep…

[@fightlikabrave]

I mean, you can create local PW vaults that store offline/locally, with PW manager services. An EASY way to protect against PW manager hacks is to use the "double blind method": You use the PW manager to generate a long unique PW for a site and save it like that in the manager, THEN you change the sites PW to that PLUS an extra "PIN" (4-8 characters extra) that you use that can be a pattern per site or just a PIN code that you add to the end of the managers saved PW. So if you have a PW manager save "df%ghd&63n398%egd8" as a PW then you add "*****"(whatever your memorized PIN is) to it, then IF someone hacks the PW manager and somehow breaks the encryption..they get a bunch of wrong/incomplete PWs and your accts are still safe. Since you control your emails you can still use those to change any PWs even IF the PW manager gets compromised.

[@pw1187]

I mean storing your password at your house on a notebook is no more less of a security threat then pass

[@NamelessStudiosInc]

you dont need a master password to open a notebook

[@TheDiner50]

​@@NamelessStudiosInc But you need to physically open the notebook. So really if you get a key logger or any remote attack thrown at you, well. Logging onto KZbin giving up your "master" password is giving the attacker the password to EVERYTHING. But with a non network or computer accessible password storage (notebook) is going to make attacks limited and take time and energy to extract anything. Or they physically brake into your home. Like if a attack is about taking your passwords then it is going to do it. But if we talk about a general safety from a big non focused attack. Well. DO NOT RELY ON IN COMPUTER CLIPBOARDS OR ANYTHING THAT CAN BE EXPLOITED WIDELY! Better not rely on stuff that can be exploited by a bad actor for big effect. Like buying a NAS server where the software (being a big target for profit) infect and ransom people simply for being a big target that pays off. Since a attacker have a good chance of a payoff going for that! But not so much attacking someones offline NAS home setup. You need to become a big target to be worried about this stuff. No! Worry about the wide attacks that can be a PAIN! Like passwords leaking outside of your control. At home you should be in control. If your afraid of some real attack? At that point wtf are you up to? I mean if they take everything your going to notice the attack and have a real problem. You lost your stuff! And if you do not notice a physical attack then you are in even bigger problems. Since then the attack was not about taking the computers but information. Passwords, data etc. But to go in to your place just for passwords or data?? What? Like common. At that point your best way to defend yourself is a gun or something... And security systems and what not. Passwords matters very little at that point since this are real attacks towards you! You need to have some serious passwords worth something that a "master" password by default is to much of a security hazard to allow. Like common you do not put the nuke passwords next to a KZbin password. So really why on earth this hole debate even exist. If you can smash the computer to bits then a sticky note is not that big of a security risk. Better avoid a attack getting that close to the computer in the first place. Really passwords fail, like most things. Really it is better to split stuff up and limit what a attack can get from you. Like having a dedicated machine for just banking. One for web etc. And make the attacks pointless. Or hard to pull off. Like there is so many point of failures that your passwords are quite frank not safe to begin with. Heck having a network of any kind is the biggest security hole you can have. So really the levels of problems are so deep that screw passwords. You got to little control around it to make it secure! Your better off not having passwords at all. They at best can be looked at as the locks on school lockers. Flimsy and easy to defeat. But do the job for wide attacks to not go nuts. Not much more. I gladly sticker stuff up that only someone physically can see from the computer users view. Since they are meant to see and know it. Not some security hole in software or hardware eyes. Unix Pass works grate on a admin level or some shit. Multi user computers kind of deal. But here we are talking passwords security at home. It should be the safest place you got. So why NOT store it there??? You live in the same room as the enemy? Why not disconnect your computer from that storage media of your passwords? Why store the keys/passwords on computers at all? It is all about laziness. Really easy password and a second layer of defense is plain better. Since then a attack can trip alarms. But that is not a option every time. So plaster passwords around your desk or server at work all you like. Since there is no security in this world. Only ways to be safer. If a password really is impotent then you learn it. Or make a safe box that no network can reach into. Physical attacks can kill you, computers can also die to a baseball bat. And both can be made to talk. :)

[@pablojp3498]

@@TheDiner50 I don't use pass, I use keypassxc with a password (20+ chars) and a keyfile. And I recently bought 2 yubikeys. Not sure about you but I feel kinda safe

[@glowiak3430]

"Strong and complicated password" the password: 'dt'

[@wikingagresor]

What about your distro's built in managers like kwalllet or gnome-paswords ?

[@hammerheadcorvette4]

When KeePassXC exits?! Why go through the trouble.

[@adriancostin9138]

Hey DT. Would it be safe to store your encrypted password store on cloud services?

[@RyanRyan-no4vt]

Depemds how strong the encryption is. AES 256 bit? Yeah sure, go ahead.

[@user-mu8xp2lr9n]

*STRONG AND COMPLICATED PASSWORD*

[@leksmut]

Where is several passwords that you have to remember before you get access to the pass : password for encrypted disk, password for login, master password for pass, in case you lost your pc and restore pass database from the cloud then password for cloud also have to be remembered. So we get 4 passwords to remember forever outside pass.

[@RolandSharp]

you would also have to have a copy of your pgp key. either printed out or on a usb key which is another vulnerability

[@FraYoshi]

@@RolandSharp pgp key which is anyway protected by password! Maybe the revokation certificate is not instead, not sure..

[@gokuldastvm]

Looks like your comments about lastpass was a prophecy!

[@TON-vz3pe]

I do write it on a paper, but in my own Alphabet and seed it with gibberish with a simple algorithm. 1000 times secured than any password manager. Also I can read it so easily.

[@chandulasamarasinghe3088]

Plz tell your opinion about bitwarden , because it also can self host

[@cylonscion5470]

wait if you did "pass name-of-service", won't the password then be in your terminal history file then?

[@danilodistefanis5990]

Good question.

[@danilodistefanis5990]

I think the output is not saved. Only the command. And you have to give it a master pass.

[@Reliktish]

The shell history save all given commands, entering a password after executing i.e pass, is an input to the programm not the shell, meaning it will never be saved in the shell history unless you accidentaly enter it in the shell itself It is the same with sudo

[@BobDoe_69]

Hey DT! please do a similar video same idea but for bookmarks! I wan to host my own bookmarks too not just passwords. Appreciate it

[@Nathanwithz]

can I ask why? because they don't need to be secret, firefox sync between mobile and desktop should be enough i think.

[@BobDoe_69]

@@Nathanwithz Because inuae multiple browsers and i change them often i dont want to import everything everywhere all the time. I rather have it all centrally saved or backed up in my private cloud and on my machine

[@viardent8823]

@@BobDoe_69 just export it to a git repo?

[@djyotta]

Keepass + Syncthing. No need to manually sync git repo, no need to import/export gpg keys. But I can see there are pros and cons to both pass and keypass

[@Josiah_Harder]

I am looking for the best way to store passwords I use for all my various crypto accounts would this be good for that?

[@jamesmackinnon6108]

How do you get the GUI menu that pops up asking for your password?

[@yousefadel6874]

Well it is kinda painful to have all passwords on my computer so if I need pass of any thing I have to go to my pc what about if I am outside .... I guess using password manager which stores pass on database and using double blind technique would be better

[@GalacticAccident]

I know some here have already mentioned bitwarden but I'd be interested in your views on self hosting it DT.

[@littlepeon]

The thing about bitwarden is that there is a master backdoor to force updates (leaked by disgruntled developer) that possibly could be used to update malware to users machine, or if company's server was hacked could force malware to users.

[@GalacticAccident]

@@littlepeon Do you have a source?

[@littlepeon]

@@GalacticAccidentyes an ex developer raised concerns: replace (dot) with actual dots: community(dot)bitwarden(dot)com/t/three-major-bitwarden-security-issues/14528

[@GalacticAccident]

@@littlepeon Thanks

[@ricomajestic]

So if I write my passwords on a notebook,I use encryption and hide the notebook somewhere in my home where no one knows that is somehow more dangerous?

[@typingcat]

Save passwords on an old Android phone that has Wi-Fi/Bluetooth disabled. The only way to retrieve passwords is physically having the phone and looking at its screen.

[@ade5324]

those how to videos are beginning to hit really close to home lately....

[@notuxnobux]

I use a "password manager" that doesn't store the passwords anywhere, yet I can synchronize the passwords everywhere in the world instantly. How you may think? simply hashing a key with a salt. So for example my password for youtube is "youtube" and my password for other websites is just the name of the website. I press a key to bring up dmenu and type youtube and it gives me my password on youtube. As such it also works everywhere, not only in the browser. I also have an android app for it.

[@renang.1724]

What hashing algorithm do you use? what if some site has a limit on the length of the password, since hashes can be big. And the salt, is just a string or do you have something else.

[@notuxnobux]

@thefallenshadow No you didn't read what i said. I said with a salt. I use argon2i and a randomly generated salt. Its impossible for somebody else to guess the password without hacking my computer (and even then they cant take the salt without a key logger). Its as safe as a password manager except you dont need to store password anywhere. Maybe you should read more about it.

[@RyanRyan-no4vt]

I mean, maybe shouldnt have posted that to KZbin cuz now the weakest link in your password security is the complexity of that salt.

[@programorprogrammed]

I do agree with the sentiment, but, there is something to be said for having your passwords out of the digital world. A keylogger can break your entire password database wide open, it can't read your password book. I've heard it put that people have a long history of maintaining physical security, but the digital world is new and so out of there control for many.

[@Nathanwithz]

you have to type the passwords in eventually. when you do, the keylogger will see it all the same.

[@user-ut9ln4vd5m]

@@Nathanwithz But they don't steal all your passwords at once then, just that single one

[@jimbo-dev]

Interesting video, I’ll still use Bitwarden and going to recommend that to others. For non technical user it is still the best choice and way better than any proprietrary alternative even if you don’t self host it.

[@maumuxas]

Bitwarden saves your password "good knows where" how can you trust it ?!

[@jimbo-dev]

@@maumuxas ah, youtube is shadowbanning me, but the decryption happens client side and the server only holds encrypted data. This is verified by third parties and I did check the source code too And in my case I have my own bitwarden server

[@maumuxas]

@@jimbo-dev I can imagine if there was third party check that data safe for hacking, but is it safe for loss ? if hackers simply delete it, you loose all your passwords. Could happen many things, like fire, electricity problems, or anything else so you loose your passwords ?!

[@rodfer5406]

Yup. Good.

[@jacobcarline4351]

That looks hard lol

[@dolbrechts1980]

just put your password in the passmanager but let out something you have to add in front or behind it that you also remember

[@nostalgia9256]

Great idea

[@dethcx22]

Personally I use Bitwarden. Hosting it on a RaspberryPi on my local network without outside access. Also allowed me to practice my Docker hosting.

[@3dge0fsou1]

Similar here. Bitwarden (or to be precise, its lightweight implementation Vaultwarden) is open source and can be self-hosted, so you get full control of the data. Have set up automated encrypted backups in cloud (in case if house burns down) and Wireguard VPN (hosted on same rpi) for accessing from smartphone outside home network. As a bonus, mobile ads get blocked by pihole (again, same rpi), when connected to VPN.

[@liftlinux9421]

DT staring at the camera & the video is not a Hey DT episode Also thinking to use pass

[@JorgeTokunaga]

I'm looking for a solution to share passwords with my coworkers, any suggestion?

[@littlepeon]

LastPass and Bitwarden both advertise team password solutions. Don't use them, so cannot advise.

[@petrbrazda88]

so your Mastodon password is not dt?

[@VulcanOnWheels]

10:30 You do have a point, asking when we last entered a password on our phones, but I do believe we can opt out of saving it on there.

[@noferblatz]

Only problem with this scheme is that there is other data associated with sites, like my username, what email address I gave them, etc. In addition, my bank has security questions and answers I have to store. Password managers typically only store a password. So years ago, Carl Welch did an article in Linux Journal about a bash password manager he had cobbled together. I took his code and adapted it to zenity, so it runs natively in X-window. All passwords (and other secret data) are in a single text file encrypted with GnuPG.

[@Nathanwithz]

pass works with usernames, emails, security questions and even 2FA

[@supyrow]

Pass with pass-otp and git. All you need.

[@rajatnegi3896]

please make a video how to sync the passwords on different systems (also android) using git

[@RyanRyan-no4vt]

dk bout git but syncthing is very good for this exact problem

[@abdulararak4672]

I'm actually using my passwords on mobile a lot.

[@ronrobinson1598]

What about a single password protected text file?

[@RyanRyan-no4vt]

I mean, it's probably more secure than like 80% of ways that other people store their passwords but you should make sure temp files of the unencrypted file are being deleted.

[@nocultist7050]

I created algorithm that allows me to convert book quotes into non-human-readable passwords on the fly. I don't manage my passwords in any software or hardware way other than my head.

[@WatchingBlue]

There ist also a GUI called QtPass

[@royboivin]

i host my own bitwarden server from my house. makes it super easy when im not at home or on my cell to make it all work.

[@themroc8231]

Don´t you want to try to review Peux Os Xmonad Edition? Given it´s -I think- the only distribution with an Xmonad official release It would interesting to hear your opinion on what they did with it.

[@justsomeguy8385]

think I'll just host a Bitwarden server on a raspberry pi

[@ShaqarudenGames]

Your really don’t understand how these password managers like LastPass, Bitwarden and 1Password work, do you?

[@TON-vz3pe]

He is feeding speculation. Password managers have a Secret key which is stored locally and never shared to the main server, and that with a combination of a password is used to decrypt the vault.

[@viniciusgotosleep]

Keepassxc ftw

[@filemot25]

You can self-host bitwarden

[@RolandSharp]

I want to use pass but I can't figure out how to backup my gpg key in a safe way.

[@RyanRyan-no4vt]

Honestly, you could just have a strong password and backup the naked key. It does mean you make the two factor security into one factor security but given a strong password that shouldn't be a big problem.

[@simplyme8753]

What is a good password manager for windows?

[@Nathanwithz]

use pass in WSL :P

[@RyanRyan-no4vt]

Keepassxc, bitwarden and lastpass

[@simplyme8753]

@@RyanRyan-no4vt thank you

[@maxarendorff6521]

This is only useful if you have the same user name and email everywhere. Bitwarden saves and autofills all my usernames and extra notes too.

[@MoopyToopy]

Not true, you can also store your usernames in the password files. And the extensions like rofi-pass can also autotype username/password/whatever into wherever you like.

[@maxarendorff6521]

@@MoopyToopy How's that supposed to work? If you copy something into Dmenu, you can either copy and paste the password or the user name, since it is two different fields on a website.

[@MoopyToopy]

@@maxarendorff6521 KZbin keeps deleting my comments so I'll try one last time. I can't speak for dmenu because I use rofi but I'm assuming it's similar. I've installed the rofi-pass extension which has a feature to autotype whatever you like into whatever program you want. It's not limited to just usernames and passwords and I use it all the time.

[@maxarendorff6521]

@@MoopyToopy Ok cool, thanks for the clarification

[@ThaiTran-ly2ok]

and then somebody really hacked lastpass =))

[@UtahTaffer]

Eh Google Keep Notes works fine for this. Just make sure your Google account password is very strong (at least 30 characters) and use 2FA with the Authenticator. Lastly limit any physical access if it's not at home. Good to go.

[@wikingagresor]

You trust Google with your passwords ?

[@UtahTaffer]

@@wikingagresor I trust their servers, they never get hacked.

[@wikingagresor]

@@UtahTaffer ok, if you don't mind some admin checking your accounts out of boredom...

[@UtahTaffer]

@@wikingagresor I'd know if there was a login from a IP I don't use. Had that issue with someone trying to login to my Warframe account from India. The 2FA stopped them.

[@RyanRyan-no4vt]

Not really about trusting Google's servers but trusting Google won't give up that info to some third party for any amount of money.

[@makielski]

I have a method with which I can always recall my passwords, they are unique and mostly look like gibberish that looks like a hash.

[@nostalgia9256]

Can you explain it ? I'm interested to know

[@makielski]

​@@nostalgia9256 They are many way to do that and I changed often through the years, but for example, in the past I was doing something like this. Use a salt, something long enough a phrase that makes sense to you. To it, you do some basic transformation like we often do, some random leet or deliberately misspelled words to make it harder to guess. Then add a pepper to it which you get from the service you want to register the password. Then the most important, how will you crumble the later result, you apply to it a series of transformation you can do manually, a classic encryption algorithm or something you made up where they key has something to do with a value you take from that same service you want to register. If it's not enough, you can still pipe the result through a hash algorithm. You should change the "salt" and the "technique" after a while. The history behind this is, back in the day when I was student, I had to use different and clean computer very often. At school they flash the hard drive each night. So, no way I could use a password manager and there were absolutely no way I put it on a paper or else. So I came up with this technique which I still use today.

[@magicmanj32]

I use bitwarden self hosted

[@TheBlueThird]

Pass is amazing. See no need to use anything else. Cloud based password managers are not a good idea.

[@errorsofmodernism9715]

Just store the password on a post it note under your keyboard that way only you will know it is there

[@b4g4b3l]

what about something for windows :D

[@Constantinus_Apollyon]

Hey if it isn't.... Buddha :D out of all ppl , next to a cup :D

[@TheDiner50]

Best way to use/manage passwords? Don't. Reset them and forget them. Your Mail is the manager of passwords and your accounts. You bind the passwords for stuff into your mail. Stuff that you use day to day you learn them by hart or rethink what you use for the day to day. Why bother with a password manager? It is just a security risk. Just make a good plan about passwords. Change them at some point just in case. Stuff I use regularly I auto login into. Security is a joke on most sites. Most places I use day to day do not require much security since if I lose them ho cares? I do not want to have my accounts hijacked, but as long as mails and important stuff is safe there is a way to recover. But stuff you do not use often just reset and forget the passwords. Copy paste stuff or somehow make a temporary password to remember for just 5min. Reset at next log in. (works grate for that odd forum or what not you use rarely) You can have a complex password that only change a little bit from site to site. So you do not have a weak password but a password that is quite the same to many sites. But not similar or short enough to be a problem if leaked. It is a hint but the passwords on outer sites can still take effort to figure out. Really there is only like 5 passwords that are critical that needs to be taken seriously in your life. Not much more or less. The passwords used ones a month resets to login. Day to day are copies. Important ones are memorized and safe in your head and stored safely. And hopefully requires more but the password to work. Like a email conformation. Like being a bit creative and making your passwords long, but you learn them properly go a long way in the password world. Change stuff per site and bam! Your probably safe enough off. Just not to short and similar site to site and your good. Mail is the real master password. They more or less IS the accounts and passwords in the end. So secure the Mails! Make enough chances site to site. Do overhauls to the copy passwords somewhat regularly. Make the mails the big attack vector. Since they are the real master password managers!

[@RyanRyan-no4vt]

Why though? Remember 6 passwords and you never have to go through the hassle again. Also you never 'forget' sites that you used, which makes your digital footprint more easily accessibke to you

[@alexanderp7521]

What if your hard drive dies and you can't restore data?

[@littlepeon]

Well you go to one of your 3 backups and restore the data...duh You do have 3 backups(one off-site) don't you?

[@sofiaknyazeva]

Anybody saw "apple-id" in 3:41? Wait DT, do you use Apple stuff?

[@Gabifuertes]

What about 2FA? What if you want to add something that's not a password (such as credit card numbers)?

[@MoopyToopy]

You can add whatever information you want to the password files that pass manages. Check the section 'Data organization' on www.passwordstore.org/ for examples.

[@yScribblezHD]

Also pass works with 2fa, you just get the pass-otp package add the token using the pass-otp command.

[@JarppaGuru]

4:08 its open source so peoples know how it works. if get hacked only need those keys and they know where they are LOL. best way do it your self, but do it way so entered password is not in command history lol

[@JarppaGuru]

2:10 smart boy. could be 2nd in world lol

[@Yadobler]

HAHAHA lastpass pwned. You called it, nice

[@AnthonyEbin]

My password is IlIlIlIlllIiya

[@user-ol4qd8nx2y]

First comment

[@DistroTube]

Confirmed!

[@user-ol4qd8nx2y]

Thanks @@DistroTube 😁

[@lamprospitsillou6325]

The only thing keeping me away from pass is that is copies passwords to clipboard , having a clipboard daemon makes it just having your passwords in history for ever... Maybe ill remove the clipd and just make the change

[@lucianoosinaga2980]

huh? does nothing with the clipboard, at least on my end. I'm on ubuntu btw. doing: $pass show some/of/my/passwords just prints the pass to stdout, what you do with that afterwards is your own choice

[@lamprospitsillou6325]

Dmenu_pass automatically passes it to the clipboard, also it would be really inconvenient just retyping it from the terminal to the browser. And something about my password appearing in plain text bothers me

[@lucianoosinaga2980]

@@lamprospitsillou6325 that's what 'reset' is for! lol My passwords are mostly human readable so I just have to see them once to remember them and then I can type them down by hand. if you have random generated ones then yeah a safe way to paste them is necessary. there's no way to easily delete your clipboard manager's history?

[@lamprospitsillou6325]

@@lucianoosinaga2980 Maybe i could remove the last line entered, that is not such a bad idea, ill just have to not copy anything else for 30 second which isn't a big deal. Maybe ill give it a shot again!

[@ecw0647]

You should really add two-step authentication to all your sites. No one cares about my Mastadon password, or whatever is the classic rationalization for using a non-secure system.

[@pissfiss]

Just make a text file. How hard is it to copy and paste?