Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I want to have a portable way to store my passwords and key pairs. While I know that this already exists e.g. as Apps for iOS or Android and counterparts for OS X or Windows which can sync and whatnot.

I do not want any of that. I want a simple, portable and open tool. I think KeePass is good point to start off, but I wanted some more opinions, so here are some points that I'd like the tool to support:

  • Portable
    • Preferrably on a very tiny USB-device that I can carry around with my keychain, so it has to be robust against physical influences
    • Runnable on most environments, OS X and Windows definitely required
    • Not needing to install any programs on the host machine
  • Secure
    • I want to be able to choose how I secure the passwords. KeePass has very nice features in this field
    • (This is the part where I'm stuck) The storage needs some way of ensuring the host machine doesn't get my passwords when I'm accessing it. I know this will not be absolutely sure, but at least I'd like some way of feeling somehow secure
  • Storage
    • I want to be able to store passwords and files (like keys)

Is there a system that supports all that? I know I would be off easier by just using already existing apps, but I'm really not comfortable entering ALL my passwords in one single location without knowing exactly how they are handled (what algorithm is used, where are they stored, how are they stored, what language is used, how can I reacquire them,...)

A couple of thoughts that came to my mind:

  • Using KeePass as main database. Also add portable versions of the program for Windows and OS X on the device itself
  • Encrypt the database using keepass and use a Passphrase to decrypt it
    • A problem here is: what if the host is keylogged? Is there a way to prevent basic keylogging when entering the passphrase? What I'm thinking are gestures, like some of the Android Lockscreens provide. Is there a system that provides this? I find a passphrase alone to not be very secure, or am I wrong in that? How can I best protect the database?

So, maybe some of you have a hint that my current thoughts are correct, or where I should inquire more on such matters, I'd really appreciate it.

share|improve this question
Your question is a little difficult to comprehend. For part of it, it seems like a tool recommendation question, which would be closed as Not Constructive, as per StackExchange rules. Another part of it hints that you'd like implementation advice, but the question is too broad to give you any useful advice - it's a big task to create a proper secure storage archive format. Finally you're asking about how to prevent files being copied, which isn't really possible. The whole idea is that the database should be designed to be useless to an attacker without the password. – Polynomial Aug 28 '12 at 14:48
If you could provide some more details about what you really want to learn about, then we can perhaps edit your question down to one coherent and specific question. Unfortunately, in its current form, we'd probably end up closing it. Which would be a shame, since it's well written and shows a decent amount of effort. – Polynomial Aug 28 '12 at 14:50
Well, it was intended as a tool recommendation question, but I'd really like to prevent it from being closed - I wouldn't know any other place to ask such a question. I have edited it now, maybe this is better? (Although it is, in essence, still a tool recommendation) – Florian Peschka Aug 28 '12 at 14:51
We don't allow tool recommendation questions here, due to the general "shopping list" question rule. If you could cut the question down to the core of what you want, without it being a shopping question (e.g. how do password managers work?) then that'd be fine. However, I think a lot of your question isn't really about that, so if you don't want to know about password managers in general, the best bet would be for us to close the question and leave it at that. – Polynomial Aug 28 '12 at 14:56
1  
Questions that aren't good candidates for a post on SO can usually be answered pretty quickly in one of the chat rooms, try there if it's something you know would be closed otherwise. – KDEx Aug 28 '12 at 14:58
show 2 more comments

closed as not constructive by Scott Pack, Polynomial, Iszi, Rory Alsop♦ Aug 28 '12 at 15:05

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.