Librem One Password Manager: "Librem Passwords?"

Not disagreeing with anything you wrote but some people like the synchronized password store accessible across multiple devices.

Storing passwords on someone else’s server is not necessarily insecure provided that

  • the encryption is solid (including a strong master password)
  • the encryption is done on the client side
  • the client side is open source

As always, it depends on your threat model. For some people a plain text copy in a locked safe would be nowhere near acceptable.

:+1:

1 Like

I have dozens of credentials. It would be hard to remember them all. It gets even harder the more the passwords are safe (longer, bigger character set, random). Password managers allow me to use very long passwords with a big set of characters (depending on what the service allows). Also passwords can be random which basically leaves attackers with brute force only, e.g. wordlist attacks do not make much sense anymore.

Also the human brain is definitely not the most safe place. People forget things every day. Especially stronger passwords are harder to remember as I said already. Passwords that you did not need for a longer period can also be hard to remember. Also something unpredictable can happen like a car accident. Good luck trying passwords when you wake up from coma. Even if this is a special case it is just an example to show that the brain is not safe.

I personally would not store passwords on a service not under my control even if they are encrypted. The encryption might now look solid but that may change in the future. So ciphers should be evaluated with the duration of their usage in mind. For some people this might be okay, but not for me.

Anyway I think FLOSS password managers are the best way to handle passwords. I never tried it, but I think some of them let you print passwords for offline backup.

1 Like

I’m happy with bitwarden, and honestly to remember the dozens of passwords, especially if you want longer, difficult to guess, passwords, it becomes next to impossible to me.

But then you probably won’t remember the master password to your password manager either. :frowning:

…and if not even you can gain access to your passwords, then I say that that indeed means your brain is the safest place to store your password(s).

I think there are two different meanings of “safe” being used here, depending on what is most important to protect against - stop someone else getting access to your stuff even if it means stopping you yourself getting access to your stuff v. balancing those two risks.

If you are a dissident in a totalitarian country then you could easily go for the former - and you wouldn’t want a paper copy in a locked container.

So you argue that a password is unsafe if literally no one knows it or how to get it? I can’t see how you would logically arrive at that conclusion.

That notwithstanding, I was making the point that if even authorized access is prevented, how can unauthorized access not be (in the context of the human brain)? Hence my facetious post.

I’m arguing that a person could reasonably use such a definition because the implied Denial of Service (to yourself) is itself a cost and a risk, and a failure of security.

It depends on what is most important.

What you call “safe” depends on what cost / risk you ascribe to someone else being able to access your stuff v. what cost / risk you ascribe to losing access yourself to your stuff.

Oh I see what you’re saying. I can’t honestly agree, but the reasons are semantic in nature and not worth either of our time. Plus I don’t actually want to be taken seriously when I say that the brain is the best place to keep your passwords because you can forget them.

you can store passwords in plain-text (digitally or printed) if you use a secret formula to generate the actual passwords/passphrases from that plain-text input.

say you take :

foraarethebestwaytostorepasswordsinplaintext

and after you apply the ‘secret’ algorithm you get

f0r@@r37h3b3$7w@y70$70r3p@$$w0rd$!npl@!n73x7

good luck typing that every time tough :rofl:

Passwords could be safe from being lost or secure of unauthorized access. I am not sure if you can get both to 100% but you could get both to a certain degree. E.g. if you trust your family members you could make a printed backup of the password manager’s DB and put it in a firesafe container. That way your PWs would be secure against remote attacks and safe against fire and neuronal problems, but not against thieves. You could use a tresor / safe but than you delegate the problems.

1 Like

You could build false wall in closet or hidden space under floor to put fireproof safe. Even inside drywall. So thieves cannot find it. If you’re always home, thanks to coronavirus, you could order alarms, improve security around your home that you get notified when anyone enters. Garage door locks that cannot be opened from outside, same with doors, sliding doors, windows, etc.

I do not trust wifi or network security like Amazon’s Ring, or ADT, indeed some serial killers are known for working at ADT. I have panel for my garage door outside, I use disinfect wipes to wipe it off after using. But it cannot work when I use latches to lock my garage door from inside. But if you go on travel, you might need someone trustworthy to watch or keep on checking your home. Or spend a lot more money to make your home more difficult to break in, like rolling security grilles for your windows and doors, more or better locks, etc.

1 Like

that are likely to occur if you wear the face diaper too much …