[kirubakaran]

What password manager would you recommend for Linux? I use KeePassX but I wish I didn't have to copy-paste passwords onto website login forms.

[narcissus]

I think Keepass2 requires Mono but if you're OK with installing that, then xdotools can be installed to autotype for you.

[edanm]

I'm wondering this also, only on OSX. I love Keepass on Windows, but the lack of auto-type on OSX is killing me.

Bonus points for something which makes having a central repo of shared passwords possible, Keepass is terrible for this.

[alexjeffrey]

I'm working on something like this at the moment, which will be released within the next few months. I can email you when it's ready if you're interested?

[edanm]

Sure, but to be completely honest, this is one of those things where I'm very unlikely to take a big chance on a new, untried software. At least, not for my business. For my personal use, sure.

I'd like to see a helluva lot of proof that you're a legit company before trusting you with this kind of information.

I say this not to discourage you, but just to explain how a business owner will think about your premise. Or at least me, don't know if this is representative of your actual audience or not.

In any case let me know when it's up, I'd love to take a look!

[alexjeffrey]

Of course, and these are problems I will be working to solve very early on. The kind of users I'm aiming for should be rightly concerned about the security of their passwords and I will be providing as many mechanisms as possible, both socially and technologically, to prove said security in a transparent way.

[InAnEmergency]

LastPass?

[kirubakaran]

I find it hard to trust a closed source app with all my passwords.

Also: https://grepular.com/LastPass_Vulnerability_Exposes_Account_...

[martinced]

None. Zero. Zilch. Nada.

Will people never learn? Do you realize what happens when your password manager itself gets compromised?

Using a password manager is trading security for conveniency. This is simply not acceptable.

I fully expect all the people using insecure security practice and all the people selling snake oil to downvote this.

The problem, however, is that you can't argue with facts. And the fact is that trading security for conveniency is a very stupid thing to do.

[guygurari]

Using a password manager allows me to assign a different random password to every site I use. This means that, if a site that uses weak hashing gets hacked (a relatively common occurrence), none of my other accounts are compromised. Do you have another practical way to achieve this level of security?

Also, note that if my password manager is compromised, it means that the attacker has some level of access to my machine, since that is where my passwords are stored. In that case it is reasonably likely the attacker can also install a keylogger. This will reveal my often-used passwords even if I do not use a password manager.

[smilliken]

What would you recommend instead? If you insist people remember all of their passwords in their head, you'll end up with them using the same password for everything.

[purephase]

I think the most common is you have a single password, but you hash it with the name of the service you're logging into.

For example, if you're password is "puppy" and you're signing-up for HN, your password would be:

pHuApCpKy

And, if you wanted to make it stronger, salt it with some special characters.

p~Hu!Ap@Cp#Ky$

... which is just the shift-characters on a number row in order.

This way, you only have to remember one password, and it is service specific, and pretty strong. No password manager needed.

Of course, I don't do this. I use a 1Password and KeepassX.

[GhotiFish]

I like the idea of hashing off a root word + site. I'd rather have the browser do it for me though, and I don't think there's anything on the page itself that I could depend on to hash with. Maybe the domain?

To be honest, firefox has an encrypted database of site-passwords. What's wrong with that?

[icebraining]

I have a system like that, that takes a master and the domain. The advantages over the Firefox password manager is availability and not having to worry about backups. Since I know the algorithm, I can recreate any password using widely available tools.

[tlrobinson]

http://cynix.org/tools/superpwdhash

http://supergenpass.com/

https://www.pwdhash.com/

[vacri]

Feel like providing a workable alternative, or are you just content to stay in your cloud of idealism with other thoughts like "everyone should change passwords for everything every 90 days"?