[udoprog]

I currently store all my passwords in a KeePass[0] database distributed using SpiderOak[1] (hassling, but only once for each device).

  [0] http://www.keepassx.org/
  [1] https://spideroak.com/

All my services have gotten 50 char (nice entropy) random passwords, and for ease of use I store them in the browser with an equally difficult master password.

My Fx settings involve flushing all cache and sessions on closing.

Apparently when setting the Fx master password, the local database appears to be using 3DES encryption in CBC mode[0] (nice and slow) which is insanely secure with long and keys. The only password I have to remember is the KeePass database, which in turn is as complicated as I can remember. The when booting up firefox, just paste the master password.

  [0] http://luxsci.com/blog/master-password-encryption-in-firefox-and-thunderbird.html

Funny enough, the SpiderOak distribution password is saved in the KeePass db, giving me a sort of chicken-or-egg problem when setting up, I'm toying with the idea of distributing the database publicly, which should be secure enough.

This means that the only password that is stored in my head is for the KeePass db, but I'm planning on replacing it with a key file (perhaps on USB), once I've figured out a usable scheme for it.

I'm just dying for the day when web services can be integrated into a proper keychain, that would spell an end to this bull.

[brown9-2]

I haven't heard of SpiderOak before, but from their site, it sounds like you create the equivalent of a private key on each device you use, so that your data is encrypted on the machine itself and never visible/readable by the SpiderOak servers (roughly). Is this correct?

How easy do you find SpiderOak to use otherwise?

[moe]

I gave SpiderOak a shot but had to give up quickly because their OSX client was an unmitigated disaster.

It may be possible to ignore the horrible UI once it's set up, but I couldn't ignore that it randomly decided to stop syncing individual files or entire folders.

On the second day I even set it up from scratch again, as I figured I might have done something wrong the first time. But on day 3 my laptop and desktop were desynced again, so I went back to unison...

[appl3star]

http://www.spideroak.com is nice but unfortunately they started to implement some file sharing features so they stopped offering true client-side encryption as well. At least they are way more secure than DropBox. Another one: https://secure.cloudsafe.com/