More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user::Security experts believe some of the LastPass password vaults stolen during a security breach last year have now been cracked open following a string of cryptocurrency heists

  • Professor_Piddles@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    32
    arrow-down
    1
    ·
    1 year ago

    Any obvious holes in keeping a text file on my laptop that I encrypt when not using it? Using ccrypt on linux.

    I do not want my passwords - even encrypted - on the cloud or at the mercy of a 3rd party in any fashion.

    • Rootiest@lemm.ee
      link
      fedilink
      English
      arrow-up
      29
      arrow-down
      2
      ·
      edit-2
      1 year ago

      Use KeePass.

      My concern with using a text file is you have to defrost it to use it and whenever it’s not encrypted it’s potentially exposed. You are also vulnerable to keyloggers or clipboard captures

      KeePass works entirely locally, no cloud. And it’s far more secure/functional than a text file.

      I personally use KeePass, secured with a master password + YubiKey.

      Then I sync the database between devices using SyncThing over a Tailscale network.

      KeePass keeps the data secure at rest and transferring is always done P2P over SSL and always inside a WireGuard network so even on public networks it’s protected.

      You could just as easily leave out the Tailscale/SyncThing and just manually transfer your database using hardware air-gapped solutions instead but I am confident in the security of this solution for myself. Even if the database was intercepted during transit it’s useless without the combined password/hardware key.

        • Rootiest@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          1 year ago

          Having a recovery process for the YubiKey would really just be a potential security hole.

          Ideally you have a backup clone of the key in case yours is lost/broken.

          Keeping a recovery seed or backup password instead would be inherently less secure as the YubiKey uses an HMAC challenge-response key for KeePass rather than a static password/key file.

          A static password or key would be a better target for hackers as it would be easier to crack so having that option would lower your overall security.

          Also worth noting that the way KeePassXC handles the HMAC challenge-response is different from how KeeChallenge does it.

          In KeeChallenge the HMAC secret is used to encrypt the database, which requires storing the encrypted secret in a separate file.

          In KeePassXC the database’s seed is used as the challenge and the response is used to encrypt the database.

          The benefit to the KeePassXC method is two-fold:

          • It’s less vulnerable as the HMAC secret never leaves the YubiKey or get stored in a file.

          • It increases security because the challenge-response changes every time you save the database (changing its seed)

          • Professor_Piddles@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Thank you for your detailed responses - I’m going to look into KeePass and maybe a Yubikey after reading your description of how it works. I hadn’t considered a Yubikey before mostly because I’m prone to lose things, but also because my encrypted file password is >12 characters and a fairly random mix of lower and uppercase letters, numbers and special characters.

        • PlexSheep@feddit.de
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          There is no recovery if you have a single hardware token in use only. But that’s a structional issue with your concept.

          Instead, it is recommended to have two (or more) identical Hardware Tokens to replace one that dies.

          It is also smart to keep the seeds for things like 2fa in some secure backup with schizophrenic paranoia proof Security measures.

      • lazynooblet@lazysoci.al
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        Absolutely, Keepass is a great alternative to cloud managed password managers.

        You are also vulnerable to keyloggers or clipboard captures

        Keepass (and most password managers) are vulnerable to this as well.

        • Rootiest@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Keepass (and most password managers) are vulnerable to this as well.

          Not if you use the browser extension

          Plus it does automatically clear the clipboard after a short time which isn’t perfect but it’s still an improvement over using a text file

        • jarfil@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          True, but KeePass has some countermeasures, like wiping the clipboard after some time, sending the password directly to a browser extension, or entering the master password on a “secure desktop” (technically not all that secure, but more secure than the lack of it).

    • ThetaDev@lemm.ee
      link
      fedilink
      English
      arrow-up
      15
      ·
      edit-2
      1 year ago

      Yes, if you write the decrypted file to disk, it could be recovered. Deleting files only removes the file system entries - it does not wipe the content.

      Use a local password manager. KeePass (use the KeePassXC variant on Linux) is the most popular choice. If you prefer a command line tool, pass (passwordstore.org) is an option.

    • trevor@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      11
      ·
      1 year ago

      Why not use KeePass then? It’s entirely local and you don’t have to risk running your own encryption solution.

    • vector_zero@lemmy.world
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      1
      ·
      1 year ago

      All it takes is a malicious program accessing your clipboard or running commands to find your password file while your machine is booted and decrypted.

      • time_lord@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        1 year ago

        If something happens to your SSD, you lose all access to everything. And SSDs can die without warning, and be un-recoverable.

    • chicken@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      1 year ago

      If we’re talking crypto keys like in the article, that would be an improvement over storing them in the cloud, but it’s still vulnerable to malware/keyloggers. Ideally you should use a dedicated hardware wallet and/or write it down physically and have some form of offline signing setup.