30

I am trying to figure out what the best solution is to store different types of passwords:

  • Personal passwords (my personal email, my company's email, all the services I use to buy things like Amazon, etc.)

  • My business passwords (all the tools used to run my business, harvest, Google apps, slack, deploybot, etc.)

  • My client's passwords, their own services which they sometimes share with me to use (like Amazon AWS, some email account they create for me, some other tools they use like Salesforce).

I know that probably I won't find one tool to rule them all, but I would like to hear your advice or experiences to deal with this same situation.

EDIT:

After more than 3 years of my original question, I would like to say that I am using LastPass as recommended by @dotancohen and it really solves most of the use cases I described, even on the free account.

6
  • Is this file soley fore your use, or do you want to provide access to others (e.g. so clients could see their passwords whilst not those of other clients)?
    – JohnLBevan
    Nov 27, 2015 at 8:23
  • access to others will be a nice to have. Meaning that probably we can leave without it, but it will be helpful to provide access to my employees and revoke access if I need to. Nov 27, 2015 at 16:18
  • Keepass.info is the best. You can share the KDBX files on Dropbox.
    – Chloe
    Nov 27, 2015 at 19:14
  • I reviewed Keepass, and the only thing i cannot find was the plugings for the browser that is really something needed at least for me. Nov 29, 2015 at 20:01
  • If the only thing missing from KeePass for you is a browser plugin, what about chromeipass for Chrome/Opera, or KeeFox for Firefox?
    – Ben
    Dec 3, 2015 at 22:49

8 Answers 8

12

For your exact use case, I personally use Lastpass. The killer features of Lastpass include the ability to compartmentalize and separate each client's passwords from each other and from my own. They also have in my opinion the best browser addon integration and the data can be stored and used offline as well.

I like to increase the password PBKDF2 iterations as that makes me just a bit harder to crack than the average user, and I absolutely will not use the service on a computer that I do not control.

4
  • 1
  • @MichaelHampton: That was a terrific article, thank you.
    – dotancohen
    Nov 28, 2015 at 9:12
  • 1
    After reviewing all the answers, i choose this one, as really solved my problem. The defects pointend in the above post have been already fixed. Nov 29, 2015 at 20:00
  • 1
    Coming back here, 8 years after my original question. Using LastPass was the best decision for my use case, and it still is, thanks again @dotancohen for your answer! Nov 24, 2023 at 17:53
26

The easiest way would be using several databases. Tools like KeePass allow you to store passwords in different files. You could for instance opt to store your passwords in seperate databases based on client or purpose.

13
  • 2
    @Neil McGuigan Dropbox (or alternatives) assumes you trust the company with your data. Sure, it's encrypted, but if anyone gets the file it's off-line brute-force attack. You could set-up your own synchronization service (ownCloud possibly) or synchronize your machines in a star topology - Unison, syncthing, gut come to mind. In case you missed conflict, KeePass at lest allows cleartext export which you can diff manually.
    – Torinthiel
    Nov 26, 2015 at 19:35
  • 3
    @Nate Kerkhofs Changing password to everything I have in keepass? Including credit card PIN, which I cannot change online? Or as OP says, his client's passwords? No, thanks, I'm not taking that chance. And you need to first know there's been a breach. If they keep it secret (or don't realize themselves, or it's an inside job, or ...) you don't know you should change your password, and won't do it.
    – Torinthiel
    Nov 26, 2015 at 21:06
  • 5
    Should point out that you should use VERY strong passwords for each KeePass database (or whatever tool...). Use a long, random passphrase (e.g. Diceware), and if you can lock it with a key file too.
    – AviD
    Nov 26, 2015 at 22:18
  • 3
    Or increase the number of transformation rounds. It's 41,266,560 for and on my pretty powerful PC it takes 4 seconds to encrypt/decrypt. With an 8 character password using lowercase, uppercase and a number you have 218,340,105,584,896 combinations. Even if you could go down to testing 1,000 keys per second (which would be 40,000 times faster than on my PC) it's over 6 thousand years to check all combinations. Though I have a 46-character password just to be sure ;).
    – Maurycy
    Nov 27, 2015 at 9:52
  • 2
    @Maurycy Now that you have stated your password length, you'll have to read through How critical is it to keep your password length secret?
    – user
    Nov 27, 2015 at 18:15
3

Six months ago, I was in the same situation as you are right now. I used to save all passwords in my MySQL database (not safe at all) and I made a Python script to extract them. That was not a good way to solve the purpose at all.
Now I use 1password to manage and secure all my passwords in a single place and encrypt them with a master password.

3

For your Personal Passwords, why not use your browser's built in, password manager? In Firefox for example you can also set up a master password which encrypts the database. So you just have to enter it anytime you open your browser.

I didn't see this as an answer so I'm wondering if there are any serious security risks that I'm unaware of.

For the other passwords I'd also suggest KeePass, as mentioned above. It's Cross-Platform and quite mature project, with a lot of functionalities managing passwords. Also storing your clients information (even encrypted) on a third party website, besides being a possible security risk, it might even be illegal for some countries.

1
  • +1, the browser password managers are great and I have no idea why third party solutions are recommended over them. Dec 21, 2015 at 22:07
2

I like pass. I realize it's not for everyone (because it's for Linux and doesn't have fancy features like browser integration or mobile support), but the reason I like it is that it's just a wrapper for git and gpg, two projects I fully trust, since they have been vetted by a huge community for years, if not decades. The script itself is short enough to read. You can make use of gpg-agent. It decrypts single passwords on demand and can copy them directly to the clipboard for a limited amount of time. The database is heavily encrypted with my PGP-key and could safely be stored on github, but I choose to sync up multiple computers differently if I needed that.

0

I simply use the excellent password manager included in Google Chrome.

  • Google Chrome is my browser of choice.
  • Password management is built right into it.
    • Convenient and easy.
  • All my web application passwords are saved.
  • Can save multiple credentials for the same site.
    • Allows you to choose between them at sign in time.
  • Integrates with the credentials management system of the underlying operating system.
    • Increased local security.
    • Asks for my local user password before displaying passwords in plaintext.
  • Synchronization with my Google account.
    • Passwords are available everywhere.
  • Works seamlessly on all major desktop and mobile operating systems.
  • Works with Google Smart Lock.
    • Allows me to sign into mobile applications using my saved passwords.
    • Can view and manage my passwords through my Google account.
  • Can provide my own passphrase for password database encryption if I want to.
    • Google can't see the data.
    • Breaks Smart Lock.
  • Includes its own password generator.
    • Improves security in general by making it easy for all users to
      • Generate unique random passwords for every site.
      • Save them.
      • Promptly forget about them.
    • Encourages good password choices and management practices.
    • Reduces susceptibility to phishing attacks.
    • Limits the damage done when a specific password is compromised.
    • Provides increased peace of mind when combined with all the other security practices.
      • For the individual users.
      • For the system administrators responsible for their security.

Chromium's Security FAQ


Firefox also comes with a great password manager. I use for some specific sites and identities. It's also capable of synchronizing passwords with a Firefox account, making it extremely convenient.

I simply can't justify paying for something like LastPass when browsers such as Firefox|Google Chrom{e,ium} already have all those features built in. They've had them since forever and they keep getting better and better.

pass appeals to the programmer in me. I think it is beautiful in its simplicity and how it is based on GNU Privacy Guard and Git, technologies I personally use and love. Unfortunately, I am currently running Windows.

6
  • lastpass is free - Chrome's password manager is exposed to anyone with access to the machine
    – schroeder
    Dec 22, 2015 at 4:18
  • @schroeder, it's not free. Paid LastPass Premium subscription is required for an essential feature like synchronization between multiple devices. You also have to pay if you want to use a security token such as a YubiKey. Chrome supports pretty much all useful features in their comparison matrix, up to Premium features, out of the box. Dec 22, 2015 at 4:47
  • @schroeder, if the attacker has unrestricted physical access to the machine, credentials can be compromised without the password manager's aid. One can simply open the email client and use the Forgot password? forms of websites to reset passwords. Even so, Chrome's password manager uses operating system mechanisms to frustrate an attacker should the user make the mistake of leaving his machine unlocked and unattended. I mentioned this in my answer. Dec 22, 2015 at 4:58
  • Lastpass is free when comparing features to the browser password manager. Your link is for Mac OS - Windows machines do not have such protection. When I say "physical access", I am not talking about access to the user account, but simply to the machine itself. Lastpass and other password managers do not have this problem. The point is that it depends on the threat model that concerns you. You cannot dismiss 3rd party password managers simply because you are using a certain threat model.
    – schroeder
    Dec 22, 2015 at 5:12
  • Can you explain "Lastpass is free when comparing features to the browser password manager"? Personally I use KeePass and sync with cloud storage, but I've been looking for an "easier" solution for family and friends, and last time I checked you needed a paid account to sync between mobile and desktop with Lastpass. I assume (but haven't actually checked) that Chrome's or Firefox's password sync features will also sync to mobile, and for free.
    – Ben
    Dec 22, 2015 at 18:13
-1

I find myself thanking agileBits 1 password now and again. It just makes the process of dividing and keeping check of a multitude of passwords so much easier.

I can honestly say that the quality and differentiation of my passwords have increased since I have complex passwords available wherever I am.

The ease of use is a factor in my opinion.

I have chosen to use their Dropbox syncing. They use PBKDF2 on the master password on top of the AES encryption on stored passwords.

-2

The option I use is to have a simple password generator, usually a one liner in bash, that I can copy between machines. Something like that

echo "site" "MYSECRETKEY" | md5sum | head -12c

Its not as fancy as a keepass and has obvious problems, you have to remember the user, you cant change the pass, etc... but it will work quick and dirty for non critical passwords

2
  • 6
    What if someone nabs your secret key from .bash_history on any one of those machines
    – Krubo
    Nov 27, 2015 at 13:47
  • 1
    Lots of sites don't allow such simple passwords consisting of only lowercase letters and numbers
    – Volker
    Nov 27, 2015 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .