[Discuss] deadmanish login?

[kentborg at borg.org (Kent Borg)]

On 02/11/2017 12:13 PM, Bill Horne wrote:
> Frankly, I think that having an unencrypted list of passwords in a 
> .txt file would be better than using the same password on multiple sites, 

I agree. That is how evil recycling passwords is.

> so any program that allows me to have well-protected password storage 
> would be worth the work of synchronizing the files 

Do be careful of automation...worry about putting your passwords in a 
standardized program commonly used by innumerable others--unless you 
wisely choose a password program that has no bugs and never will have 
any bugs.

However, if that perfect program proves elusive, then at least stay away 
from programs with dangerous features. Pick a program that offers a 
simple well defined encryption service, don't choose one that takes 
responsibility for all kinds of cool stuff, makes your life *so* much 
easier, and gets convenient new features added everyday it seems! Boring 
and more manual is safer. Open source is safer than commercial, too.

If you have your passwords in a standardized place and there is ever a 
standardized crack, you might be part of the bulk-rate haul. In 
contrast, a plain text file (with a misleading and boring name) offers 
an obscurity that is valuable. (Cue cliches about "security through 
obscurity"...) Part of its virtue is having exceedingly few features, 
someone would need to put customized effort into breaking into your world.

-kb, the Kent who remains very frightened by things like Lastpass.