26

For any passwords other than websites I log into regularly (such as Gmail, Facebook, etc.), I use apg to generate a random 20 character password. I then add that password and a username or email address to a text file I keep stored in an encrypted VeraCrypt volume (password for that exists solely in my head).

In light of the Collection #1 breach, I'm planning to go through and change some of my passwords, and I'm wondering about the benefits of using a password manager such as Encryptr or Gnome Keyring. I usually use Mint with Cinnamon.

Is storing passwords in an encrypted file considered adequate for most peoples' needs? Even if it is, are there other benefits to using a password manager?

|improve this question
  • Please ping me if this is not a helpful migration. Thanks! (SU ♦) – studiohack Jan 18 at 17:57
  • @studiohack Not a problem. Thanks for migrating it. – CMB Jan 18 at 21:22
  • 1
    A password manager is special-purpose encrypted file with some additional features and better hardening against potential attacks. – caw Jan 20 at 22:46
28

Having an encrypted text file with passwords in it is certainly better then having common/reused passwords or an unencrypted file.

A good password manager is, however, incrementally better, in the following ways (off the top of my head)

  • Better memory management - it can prevent passwords being left in computer memory which can be snaffled by other processes/users.
  • It only exposes the needed password, not all of them.
  • (Sometimes) Browser integration makes life easier
  • Many eyes - a program designed specifically for password management, and audited, likely has stronger processes in place to ensure good hygene.
  • Cross-platform compatibility, arguably easier to merge records and manage in a cloud environment/from multiple locations.

You might want to look at Keepass and other variants, and the kdbx format. (And how well its supported). I use that under Linux (I assume you use linux as you mention APG)

|improve this answer
  • 10
    With a password manager you can even copy passwords without showing them on the screen, so people around you won't even see that one password. – Máté Juhász Jan 18 at 6:31
  • 6
    Not to mention that a password manager can autogenerate very strong, random passwords, using a variety of algorithms. – Ian Kemp Jan 18 at 7:45
  • 9
    Browser integration does not only make life easier; it's also a great way to avoid phishing. A website can fool a user, but definitely not the browser and an extension. If you try to log into a site and password autocompletion doesn't kick in, it's a red flag! – Fabio says Reinstate Monica Jan 18 at 10:10
  • 6
    My worry with password managers is that they seem a very likely target for a hack. Whereas the secured file stored locally on my machine or usb-drive are not (assumptions on my part). – Deruijter Jan 18 at 14:41
  • 3
    @Deruijter, if you're too concerned with a cloud-based password manager, just get a local-only one, like KeePass or PasswordSafe or any number of other systems that store content only locally. – Ben Jan 18 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.