0

My solution to store passwords is just using this free program, SafePad, and then writing in a document all my passwords, plain text; for example a line might be

Facebook.com - user: johnsmith - password: prettyball00ns

The document is then encrypted with two passwords. I have various backups of this document spread in a few different places (so losing it is completely unrealistic). I have also saved the code and the .exe of SafePad in all those different places, just in case.

Now, I know I am vulnerable to things like keyloggers (that could record me typing my master passwords), but so are the other types of password managers I think... I am writing here to know: is my approach bad? Could I do better? If yes, how?

3
  • In addition to everything ThoriumBR said, why would you even consider such an option instead of using an established PW manager like KeePass(2/XC)? Feb 18, 2019 at 8:31
  • No idea of how these work, and I can't understand possible vulnerabilities or long-term support. An encrypted file however is something "easy" that I can use forever (which is why I am asking these things here) Feb 18, 2019 at 11:38
  • And you know how SafePad - an obscure program with less than 20 stars on GitHub - works? You know how long-term support for that solution is going to be, given that the last commit was in April 2017? IMO, your approach is way more insecure than using an established password manager like KeePass, see ThoriumBR's answer. Feb 20, 2019 at 20:18

1 Answer 1

2

I can see a couple issues:

1. You are still vulnerable to phishing.

Using a proper password manager will protect you from a site using homoglyphs to look like the official site. For example, fаcebook.com and facebook.com. They look identical, but on the former, the a is not the Latin a, but the Cyrillic version. You cannot visually identify the forgery.

2. You cannot easily generate TOTP tokens

You can save the shared key on your password file, copy the key and use another program or script to calculate the token for you. But would you? Probably not.

3. Backing up by hand is a hassle

You can forget to backup after a critical password change and get locked out, or at least have to reset the password. You may end up with different sets of files, and have to remember which one is the most recent. You have to be disciplined to replicate every change among your multiple locations.

4. Browser integration and user interface

This is more a usability issue. With a proper password manager, you get a dialog box to save any new login on its database, and to change the stored password when you change it on the site, you can audit your passwords to see the age of each one, you can auto-generate strong passwords without being bitten by the lack of randomness every human suffers from, and so on.

There's a saying don't create your own crypto, unless you are a cryptographer. I would say don't invent your own password manager unless you are a security savvy, expert programmer. There's lots of password managers around, just choose one and be happy. And safe.

3
  • 2
    In addition, the lack of ability to quickly generate new random passwords is a big issue in terms of usability and practical security
    – Natanael
    Feb 18, 2019 at 0:19
  • Which one would you suggest? Or is there a reliable guide about which one might be best depending on the user's needs? Feb 18, 2019 at 0:27
  • I use enpass.io. They don't have a cloud, don't charge a monthly fee, and have very good platform coverage (Linux, Windows, MacOS, iOS, Android). Syncs with Dropbox, Google Drive, OneDrive, Box... And they charge only for the mobile version.
    – ThoriumBR
    Feb 18, 2019 at 0:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .