Pros and cons of my method of storing passwords in plain text files instead of a password manager (on linux)

Question

I thought of this way of managing passwords without using an external password manager.

1. The hard disk is fully encrypted (of course).
2. The passwords and all the data you need are stored in plain text files, organized however you want.
3. The directory that contains all the password files is owned by root and nobody else will have permissions to read/write/execute.
4. You can code your simple custom shell script to get the data from that directory, depending on how you organized your data: the script will need to be run with "sudo" to access the directory, it might grep file titles or contents, it might even print the passwords invisibly (using terminal escape codes), etc. Whatever you want.
5. The backups of the passwords will simply be mane together with the backups of the rest of your HDD, on an external medium that will be fully encrypted like your HDD (of course).

PROS compared to password managers:

• It's simple and customizable. You don't need to rely on any external tools or applications that: might have bugs or vulnerabilities, might be targeted specifically by attackers because they are sufficiently popular, might not be flexible enough if you want to organize or access your data in a different way, might stop being maintained, might leave you with formats difficult to handle/convert in the future, etc.
• You can really rely on one single password to be able to remember all the others, because in case of "trouble" you would only need to remember the password to decrypt your HDD (or your HDD backups, which is the same data and so can use the same password) to be able to recover all your passwords. With a password manager instead, you would have to remember the password for your HDD encryption AND the password of the password manager... unless you backup your password manager data separately on non-encrypted media, or use the same password for your HDD and your password manager (and I personally wouldn't like to have to type the HDD password multiple times during a session increasing the probability it is stolen, instead of just typing it at boot).

CONS compared to password managers:

• It doesn't have auto-type capabilities. Which might not always work anyway, and then there's always the argument "if your system is compromised with malicious code running on it, then it's all speculation". For example I wonder how difficult it is for a simple malicious application to just pretend it's a fake copy of your password manager and steal your master password (and then read all your passwords from the database and "call home").
• No synchronization with other devices. Which by the way would imply that your data has to leave your devices and is sent/copied to a server, and not everybody would want that (I wouldn't).

Is there anything wrong with my reasoning? Are there any other important pros or cons I should be aware?

Answer 1

It always comes down to threat models. What kind of attacks are you trying to stop?

The biggest problem I see with this approach is that it relies on disk encryption for the data-at-rest in the file, which is essentially lifted as soon as the user logs in. Now, your plain text passwords are only protected by your OS root file system permissions.

As a normal user, you browse a website and get a drive-by download which can execute code as your normal user. It is now inside the encryption perimeter. Any local priv-esc can now dump your password file.

The encryption "gate" is tied to your user login, so any process running as you is already past that step.

What you list as a "pro" for security, I'd put in the "con" category:

(and I personally wouldn't like to have to type the HDD password multiple times during a session increasing the probability it is stolen, instead of just typing it at boot).

I'd think typing it multiple times, once per time you need to access the secure contents, would increase your security. Think of it like a timeout on access to your secrets. If you stay logged in, that plaintext password file is only being protected by OS file perms. You could walk away and leave your screen unlocked, or someone could just steal the laptop.

The point is, data is decrypted as long as you are logged in. The bother of multiple entries of your master password gets you access to just the secondary credentials you need, when you need them, and no more. They otherwise remain encrypted.

Your system is probably just fine in practice, but there is a difference. That's why I said it really depends on your threat model.

Answer 2

One additional security drawback of using plaintext files in an encrypted harddrive, is increased likelihood of accidentally compromising yourself.

For example: a common mistake some people make is to create a github repo of their home folder, containing a browser profile (or similar folder) containing plaintext passwords. It may be encrypted when you are not logged into your user account, but here you've copied the plaintext to the Internet and done the decryption work for any potential attackers. Consider also: online backup services (perhaps even Google's new Drive replacement if you're a Windows user), zip files attached to bug reports, etc.

If you accidentally publicly upload your encrypted password manager database, no harm done. If you accidentally upload your plaintext files, you lose.

An additional usability drawback is the difficulty in sharing your passwords between devices. Do you really never log into any of your accounts on multiple devices? Many password managers have options for securely sharing the database between devices. You will need to manage this manually for your system. Some devices may not even have a safe root/sudo method to keep the files inaccessible to other users/processes. Some devices may make copy-paste extremely cumbersome. If you need to deal with opening a root terminal and copy-pasting text files somewhere in your system every time you use a bank app on your phone, I'd bet you'll eventually just make the password simpler so you don't need to deal with that.