I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they haven't been compromised. Same goes for using an RSA Key.
My Idea of a Solution:
I'd have a dedicated unix box (perhaps bsd, perhaps debian) hosted in my cloud. It would have gpg, pass, pwgen, and a ssh server.
This box would only be accessible with the keyfile, and I'd generate a unique key for each client of mine. In case of a compromised device, I can revoke that key.
I would generate passwords using pass, which generates, manages, and using a gpg key encrypts passwords.
I would backup my password-store using
git
,rsync
, or some sort ofcron job
to push the password-store throughsftp
, but a digital copy of my gpg key would never leave the server.I'd keep a copy of my gpg key as a qr code in a safety deposit box.
Does this seem like a working model or are there already holes? Am I in over my head trying to roll my own password management system?
pass
,gpg
,ssh
, and everything else in your UNIX-based OS of choice but not KeePass(X) or LastPass? I don't mean to express doubt, but this seems like a useful point to consider.