6

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode.

Read more here:

Other password managers support Yubikey for login to your online vault (using Yubikey's One-Time-Password capabilities) but the password database is still only encrypted using a master password.

My problem is, that I need a platform manager that works on both Mac and Windows but Password Safe is Windows only.

Does anybody know of a password manager that:

  • Works on at least Mac and Windows (but Linux would also be nice)
  • Supports encryption using a hardware token (like Yubikey, but not necessarily that token)
Improve this question
4
  • As far as I know (which may not be much). It's impossible to encrypt something with a one-time password for encryption as it changes every time, you'll never get the same key again (theoretically). You could always set your Yubikey up to output a static password (which you can use as the encryption key) as well as the OTP. But this kinda defeats the two-factor authentication as both passwords are stored in the same place.
    – Dracs
    Commented Jun 11, 2012 at 3:55
  • 1
    I am not talking about using OTP for encryption. But Yubikey also supports challenge-response using a secret key stored on the Yubikey. Follow the link in the question to read more.
    – mgd
    Commented Jun 11, 2012 at 6:52
  • @mdj Sorry, didn't realise Yubikey's supported challenge-response. I'll have to play around with mine a little more.
    – Dracs
    Commented Jun 11, 2012 at 10:04
  • I have same problem. Now I use Keepass for windows and keepass in virtual machine for mac with plugin CertKeyProviderPlugin.plgx and eToken for store certificate. I need program for native work with any hardware token in windows and mac.
    – user10539
    Commented Jun 11, 2012 at 17:07

1 Answer 1

Reset to default
1

Looks like I mis-read the question so thanks to Dracs for pointing that out.

I had a similar problem and went with local storage for certain passwords across Windows and Mac. I went with KeePass for both Windows and MAC, though I had to use different versions as KeePass isn't officially supported on on Mac afaik and it's called KeePassX and the MAC version is a little flaky tbh but it works. You can have two separate Yubikeys, one for each platform, with an appropriate back-up scenario in case you lose the key. The link to setting up Yubikey on Keepass is here - http://keepass.info/help/kb/kb090227_yubikey.html - scroll to the bottom of the page.

This solution really isn't scalable (as you need multiple keys and it's not as easy-to-use as say 1password or Lastpass), is very manual but it works and it ensures that the password database on the two systems are encrypted using the static password from yubikey.

There's currently a feature request to integrate Yubikey - http://support.agilebits.com/discussions/1password-38-for-mac-from-agilebits-website/17016-yubikey-support - so that would possibly help you but the 1password team don't seem keen on incorporating that functionality.

Improve this answer
4
  • I mis-read the question and so re-edited the answer. Thanks for pointing my mistake out. If you feel it's still not an answer, let me know and I'll change it to a comment.
    – Mark Hillick
    Commented Jun 11, 2012 at 11:41
  • @MarkHillick - Your answer still does not provide a way for the YubiKey the hardware key to the encryption itself.
    – Ramhound
    Commented Jun 11, 2012 at 19:33
  • 1
    @MarkHillick – Sorry, but this is not what I am after. Using the Yubikey in static password mode does not provide me more security, but just a simple way to remember and enter my password. What I want is to use the challenge-response capabilities of Yubikey in which a secret, non-readable key is stored on the Yubikey. You can then challenge the Yubikey and get a response based on your input and the secret key. This can be used for encryption and decryption and requires the possession of the physical Yubikey token.
    – mgd
    Commented Jun 11, 2012 at 20:53
  • @mgd sorry, I thought the static password was a possible soln for you. I've previously contacted yubico on Twitter & they were very helpful & responsive. Might be worth doing? I'd be interested to hear their thoughts.
    – Mark Hillick
    Commented Jun 12, 2012 at 8:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .