4

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they haven't been compromised. Same goes for using an RSA Key.

My Idea of a Solution:

  • I'd have a dedicated unix box (perhaps bsd, perhaps debian) hosted in my cloud. It would have gpg, pass, pwgen, and a ssh server.

  • This box would only be accessible with the keyfile, and I'd generate a unique key for each client of mine. In case of a compromised device, I can revoke that key.

  • I would generate passwords using pass, which generates, manages, and using a gpg key encrypts passwords.

  • I would backup my password-store using git, rsync, or some sort of cron job to push the password-store through sftp, but a digital copy of my gpg key would never leave the server.

  • I'd keep a copy of my gpg key as a qr code in a safety deposit box.

Does this seem like a working model or are there already holes? Am I in over my head trying to roll my own password management system?

Improve this question
13
  • 3
    Something I don't think you mentioned: why do you expect to be able to trust pass, gpg, ssh, and everything else in your UNIX-based OS of choice but not KeePass(X) or LastPass? I don't mean to express doubt, but this seems like a useful point to consider.
    – David Z
    Apr 25, 2014 at 22:43
  • 1
    KeePassX doesn't have a cli interface and with LastPass I'm trusting my passwords to a closed source application that stores backups on someone else's servers.
    – 3h8d
    Apr 25, 2014 at 22:52
  • 3
    If you've come to the conclusion that you need to improve your security, almost the worst possible way to begin would be to design and attempt to build something yourself.
    – Stephen Touset
    Apr 25, 2014 at 22:56
  • 1
    @DavidZ I re-read your comment, here's an actual response. Apologies. KeePassX seems trustworthy but I don't want to keep my passwords managed locally incase I loose a device. I want to manage my passwords remotely, and be able to cut access to a laptop that gets stolen. KeePassX doesn't have a cli and remote desktop sounds like a drag. Lastpass is closed source, non-free, and I don't really know what's happening with the backup of my passwords they hold. I'd rather not lock myself in to a vendor like Lastpass and have to use their extensions. A terminal interface fits my workflow.
    – 3h8d
    Apr 25, 2014 at 23:00
  • 1
    @StephenTouset I'm not building tools so much as I'm building a workflow to use tools that already exist. Perhaps you see something I'm doing wrong with the tools I'm using?
    – 3h8d
    Apr 25, 2014 at 23:03

3 Answers 3

Reset to default
1

You proposed method basically amounts to storing the cleartext passwords on a rented virtual machine, which is actually less secure than a normal password storage service, assuming it is properly implemented to perform all of the encryption on the client. Since the passwords are generated on that machine and the encryption key is stored on that machine, you are relying on the security of the machine, which means you are trusting the operator of the cloud service, and are also trusting that there won't be a vulnerability in SSH or some other network software you are running that allows an attacker to gain access to the machine. (Encrypting the passwords on the virtual machine doesn't accomplish much since the key is also stored there.)

Improve this answer
0

ideally you'd encrypt the whole drive to prevent manipulation from local access. the following article lists some tips on how to protect local consoles:

but then you need some way to enter the the password/keyfile during boot-time, either via local acces or some kind of serial console; the perfect solution would be a box that only you have local access to.

in super-paranoid-mode you'd have some file-integrity-checker running like tripwire or ossec; i'd prefer tripwire, since you can store the check-database on a remote device.

there's more stuff you could do like a remote logserver and a NIDS like ossec, but this really depends on your level of paranoia and amount of worktime you want to dedicate to that project.

p.s.: this simple script, wrapped into gpg for de/encrypting during startup/shutdown might be a simple solution for a password-store; but pass looks a little more mature :)

Improve this answer
0

If your primary reason not to use KeePass is that there is no cli interface, there actually is one: http://kpcli.sourceforge.net/

The source code (in perl) is (necessarily) available, so you can verify for yourself that it isn't compromised - I doubt that verification is any less secure than rolling your own.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .