2 Textual improvements
source | link

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeypassKeePass/Lastpass due to having to trust they haven't been compromised. Same goes for using an RSA Key.

My Idea of a Solution:

  • I'd have a dedicated unix box (perhaps bsd, perhaps debian) hosted in my cloud. It would have gpg, pass, pwgen, and a ssh server.

  • This box would only be accessible with the keyfile, and I'd generate a unique key for each client of mine. In case of a compromised device, I can revoke that key.

  • I would generate passwords using pass, which generates, manages, and using a gpg key encrypts passwords.

  • I would backup my password-store using gitgit, rsyncrsync, or some sort of cron jobcron job to push the password-store through sftpsftp, but a digital copy of my gpg key would never leave the server.

  • I'd keep a copy of my gpg key as a qr code in a safety deposit box.


Does this seem like a working model or are there already holes? Am I in over my head trying to roll my own password management system?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against Keypass/Lastpass due to having to trust they haven't been compromised. Same goes for using an RSA Key.

My Idea of a Solution:

  • I'd have a dedicated unix box (perhaps bsd, perhaps debian) hosted in my cloud. It would have gpg, pass, pwgen, and a ssh server.

  • This box would only be accessible with the keyfile, and I'd generate a unique key for each client of mine. In case of a compromised device, I can revoke that key.

  • I would generate passwords using pass, which generates, manages, and using a gpg key encrypts passwords.

  • I would backup my password-store using git, rsync, or some sort of cron job to push the password-store through sftp, but a digital copy of my gpg key would never leave the server.

  • I'd keep a copy of my gpg key as a qr code in a safety deposit box.


Does this seem like a working model or are there already holes? Am I in over my head trying to roll my own password management system?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they haven't been compromised. Same goes for using an RSA Key.

My Idea of a Solution:

  • I'd have a dedicated unix box (perhaps bsd, perhaps debian) hosted in my cloud. It would have gpg, pass, pwgen, and a ssh server.

  • This box would only be accessible with the keyfile, and I'd generate a unique key for each client of mine. In case of a compromised device, I can revoke that key.

  • I would generate passwords using pass, which generates, manages, and using a gpg key encrypts passwords.

  • I would backup my password-store using git, rsync, or some sort of cron job to push the password-store through sftp, but a digital copy of my gpg key would never leave the server.

  • I'd keep a copy of my gpg key as a qr code in a safety deposit box.


Does this seem like a working model or are there already holes? Am I in over my head trying to roll my own password management system?

    Tweeted twitter.com/#!/StackSecurity/status/459838123074400256
1
source | link

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against Keypass/Lastpass due to having to trust they haven't been compromised. Same goes for using an RSA Key.

My Idea of a Solution:

  • I'd have a dedicated unix box (perhaps bsd, perhaps debian) hosted in my cloud. It would have gpg, pass, pwgen, and a ssh server.

  • This box would only be accessible with the keyfile, and I'd generate a unique key for each client of mine. In case of a compromised device, I can revoke that key.

  • I would generate passwords using pass, which generates, manages, and using a gpg key encrypts passwords.

  • I would backup my password-store using git, rsync, or some sort of cron job to push the password-store through sftp, but a digital copy of my gpg key would never leave the server.

  • I'd keep a copy of my gpg key as a qr code in a safety deposit box.


Does this seem like a working model or are there already holes? Am I in over my head trying to roll my own password management system?