26

For any passwords other than websites I log into regularly (such as Gmail, Facebook, etc.), I use apg to generate a random 20 character password. I then add that password and a username or email address to a text file I keep stored in an encrypted VeraCrypt volume (password for that exists solely in my head).

In light of the Collection #1 breach, I'm planning to go through and change some of my passwords, and I'm wondering about the benefits of using a password manager such as Encryptr or Gnome Keyring. I usually use Mint with Cinnamon.

Is storing passwords in an encrypted file considered adequate for most peoples' needs? Even if it is, are there other benefits to using a password manager?

3
  • Please ping me if this is not a helpful migration. Thanks! (SU ♦)
    – studiohack
    Commented Jan 18, 2019 at 17:57
  • @studiohack Not a problem. Thanks for migrating it.
    – CMB
    Commented Jan 18, 2019 at 21:22
  • 1
    A password manager is special-purpose encrypted file with some additional features and better hardening against potential attacks.
    – caw
    Commented Jan 20, 2019 at 22:46

1 Answer 1

27

Having an encrypted text file with passwords in it is certainly better then having common/reused passwords or an unencrypted file.

A good password manager is, however, incrementally better, in the following ways (off the top of my head)

  • Better memory management - it can prevent passwords being left in computer memory which can be snaffled by other processes/users.
  • It only exposes the needed password, not all of them.
  • (Sometimes) Browser integration makes life easier
  • Many eyes - a program designed specifically for password management, and audited, likely has stronger processes in place to ensure good hygene.
  • Cross-platform compatibility, arguably easier to merge records and manage in a cloud environment/from multiple locations.

You might want to look at Keepass and other variants, and the kdbx format. (And how well its supported). I use that under Linux (I assume you use linux as you mention APG)

17
  • 10
    With a password manager you can even copy passwords without showing them on the screen, so people around you won't even see that one password.
    – Máté Juhász
    Commented Jan 18, 2019 at 6:31
  • 6
    Not to mention that a password manager can autogenerate very strong, random passwords, using a variety of algorithms.
    – Ian Kemp
    Commented Jan 18, 2019 at 7:45
  • 10
    Browser integration does not only make life easier; it's also a great way to avoid phishing. A website can fool a user, but definitely not the browser and an extension. If you try to log into a site and password autocompletion doesn't kick in, it's a red flag! Commented Jan 18, 2019 at 10:10
  • 6
    My worry with password managers is that they seem a very likely target for a hack. Whereas the secured file stored locally on my machine or usb-drive are not (assumptions on my part).
    – Deruijter
    Commented Jan 18, 2019 at 14:41
  • 3
    @Deruijter, if you're too concerned with a cloud-based password manager, just get a local-only one, like KeePass or PasswordSafe or any number of other systems that store content only locally.
    – Ben
    Commented Jan 18, 2019 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .