I thought of this way of managing passwords without using an external password manager.
- The hard disk is fully encrypted (of course).
- The passwords and all the data you need are stored in plain text files, organized however you want.
- The directory that contains all the password files is owned by root and nobody else will have permissions to read/write/execute.
- You can code your simple custom shell script to get the data from that directory, depending on how you organized your data: the script will need to be run with "sudo" to access the directory, it might grep file titles or contents, it might even print the passwords invisibly (using terminal escape codes), etc. Whatever you want.
- The backups of the passwords will simply be mane together with the backups of the rest of your HDD, on an external medium that will be fully encrypted like your HDD (of course).
PROS compared to password managers:
- It's simple and customizable. You don't need to rely on any external tools or applications that: might have bugs or vulnerabilities, might be targeted specifically by attackers because they are sufficiently popular, might not be flexible enough if you want to organize or access your data in a different way, might stop being maintained, might leave you with formats difficult to handle/convert in the future, etc.
- You can really rely on one single password to be able to remember all the others, because in case of "trouble" you would only need to remember the password to decrypt your HDD (or your HDD backups, which is the same data and so can use the same password) to be able to recover all your passwords. With a password manager instead, you would have to remember the password for your HDD encryption AND the password of the password manager... unless you backup your password manager data separately on non-encrypted media, or use the same password for your HDD and your password manager (and I personally wouldn't like to have to type the HDD password multiple times during a session increasing the probability it is stolen, instead of just typing it at boot).
CONS compared to password managers:
- It doesn't have auto-type capabilities. Which might not always work anyway, and then there's always the argument "if your system is compromised with malicious code running on it, then it's all speculation". For example I wonder how difficult it is for a simple malicious application to just pretend it's a fake copy of your password manager and steal your master password (and then read all your passwords from the database and "call home").
- No synchronization with other devices. Which by the way would imply that your data has to leave your devices and is sent/copied to a server, and not everybody would want that (I wouldn't).
Is there anything wrong with my reasoning? Are there any other important pros or cons I should be aware?