November 2014 - WLUG - wlug.mailman3.com

Re: [Wlug] Cross platform password management

by Michael Voorhis

>From SANS newsBites v16n93; relevant (perhaps) to recent discussions. > --Citadel Trojan Now Targeting Password Managers > (November 19 & 20, 2014) > The Citadel Trojan, which in the past has been used to steal bank > account access credentials and was used in targeted attacks against > Middle Eastern petro-chemical companies, has recently been used in > attacks against password managers. The newest version of Citadel now > targets the master passwords for the three most widely used password > management systems. > http://www.darkreading.com/operations/identity-and-access-management/new-ci… > http://arstechnica.com/security/2014/11/citadel-attackers-aim-to-steal-vict… > [Editor's Note (Honan0: If you have not done so already its time to turn > on the two factor authentication features on your account that many of > these password managers offer.]

Nov. 23, 2014

Re: [Wlug] Cross platform password management

by Charlie Stevenson

Another vote for KeePass =) On Sat, Nov 15, 2014 at 6:25 PM, JeffA Maillists <jeffa.maillists(a)gmail.com> wrote: > KeePass is awesome... ;-) > On Nov 15, 2014 6:22 PM, "Frank Sweetser" <fs(a)wpi.edu> wrote: > >> Hey all, >> >> I'm looking to overhaul my password management, so I'm looking for >> suggestions on what apps people are using. My ideal system would have at >> least these features: >> >> - cross platform on windows, Linux, and android >> - synchronize via 3rd party cloud storage, preferably google drive - >> *not* via an app specific service >> - good Firefox plugin >> >> Any suggestions on what to try, or to avoid, would be greatly >> appreciated. Thanks all! >> -- >> Sent from my Android device with K-9 Mail. Please excuse my brevity. >> _______________________________________________ >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug >> >> > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > > -- *Charles K Stevenson* *Information Technology Manager**Telephone:* +1 978-355-4378 ext. 250 Insight Meditation Society <http://www.dharma.org/> | 1230 Pleasant St., Barre, MA 01005 [image: https://www.linkedin.com/in/charliestevenson] <https://www.linkedin.com/in/charliestevenson> The Frederick P. Lenz Foundation for American Buddhism grant recipient <http://fredericklenzfoundation.org/insight-meditation-society> IMA Best in Class Award award recipient in the nonprofit category <http://www.interactivemediaawards.com/winners/certificate.asp?param=268701&…> 2015 Retreat Schedule <https://www.dharma.org/meditation-retreats/retreat-center/retreat-center-sc…> | Donate Now <https://www.dharma.org/ims/donations.php> | About Us <https://www.dharma.org/about-us> | e-Newsletter Signup <https://www.dharma.org/mailing-list-request>

Nov. 17, 2014

Re: [Wlug] Cross platform password management

by Joel

Security questions aside, for synchronization of Android files to Google Drive I like "Autsync for Google Drive" from metactrl. Was $3 to buy & install. Set & forget delta sync of pictures, pdf files, etc. I tell it to only sync every 4 hours via WIFI. Taking a picture toggles a sync now. Thank you, Joel On November 16, 2014 12:53:38 AM Randall Mason <clashthebunny(a)gmail.com> wrote: I use password store (http://www.passwordstore.org/) It's the only true Unix solution. It's written in bash, stores passwords in a gpg encrypted text file, and sync is done with git. It's in most repos and homebrew. It includes niceties such as password generation and versioning is nice too (I used my old password for Facebook on Reddit, but forgot to write it down, but now I've changed my Facebook password becomes a simple git log/checkout). If anything ever happens, everything is stored in a format you can easily grok. I have a private repo on my home NAS that I can get to from anywhere. I have a chroot on android; all of those utilities exist natively on Win/Mac/Linux. Because I trust gpg enough, I could even use a free private repo on bitbucket. Just transfer your password encryption subkey around safely. There are various clients/guis out there including supposedly iOS and Firefox. It wouldn't be hard to write one for Android given all the pieces exist separately in open source forms. On Nov 16, 2014 4:58 AM, "Frank Sweetser" <fs(a)wpi.edu> wrote: > > Nice! The last time I looked, there were some issues with just dumping the > database file on Google drive, so it sounds like they've made some progress > since then. I'll check it out. > > Frank Sweetser fs at wpi.edu | For every problem, there is a solution > that > Manager of Network Operations | is simple, elegant, and wrong. > Worcester Polytechnic Institute | - HL Mencken > > On 11/15/2014 9:05 PM, Richard Klein wrote: > > Frank, > > You just save your .kdb (or is it .kdbx?) file on Google Drive. > It's just > > a file that you open and save from KeePass, so KeePass doesn't have to > support > > Google Drive per se. > > > > I used KeePass for a while, but I prefer LastPass. You said you > didn't > > want an app-specific cloud solution, so I guess that rules out LastPass, > but > > it's what I like. I also pay something like $12/year to LastPass, but > it's > > worth it. > > > > On Sat, Nov 15, 2014 at 6:28 PM, Frank Sweetser <fs(a)wpi.edu > > <mailto:fs@wpi.edu>> wrote: > > > > Any suggestion for any of the android app variants/clones to try? The > > couple that I looked at only claim Dropbox support, not google drive. > > > > > > On November 15, 2014 6:25:58 PM EST, JeffA Maillists > > <jeffa.maillists(a)gmail.com <mailto:jeffa.maillists@gmail.com>> > wrote: > > > > KeePass is awesome... ;-) > > > > On Nov 15, 2014 6:22 PM, "Frank Sweetser" <fs(a)wpi.edu > > <mailto:fs@wpi.edu>> wrote: > > > > Hey all, > > > > I'm looking to overhaul my password management, so I'm > looking for > > suggestions on what apps people are using. My ideal system > would > > have at least these features: > > > > - cross platform on windows, Linux, and android > > - synchronize via 3rd party cloud storage, preferably google > drive > > - *not* via an app specific service > > - good Firefox plugin > > > > Any suggestions on what to try, or to avoid, would be greatly > > appreciated. Thanks all! > > -- > > Sent from my Android device with K-9 Mail. Please excuse my > brevity. > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > > http://mail.wlug.org/mailman/listinfo/wlug > > > > > ------------------------------------------------------------------------------ > > > > Wlug mailing list > > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > > http://mail.wlug.org/mailman/listinfo/wlug > > > > > > -- > > Sent from my Android device with K-9 Mail. Please excuse my brevity. > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > > http://mail.wlug.org/mailman/listinfo/wlug > > > > > > > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org > > http://mail.wlug.org/mailman/listinfo/wlug > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > ---------- _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

Nov. 17, 2014

Re: [Wlug] Cross platform password management

by Randall Mason

I use password store (http://www.passwordstore.org/) It's the only true Unix solution. It's written in bash, stores passwords in a gpg encrypted text file, and sync is done with git. It's in most repos and homebrew. It includes niceties such as password generation and versioning is nice too (I used my old password for Facebook on Reddit, but forgot to write it down, but now I've changed my Facebook password becomes a simple git log/checkout). If anything ever happens, everything is stored in a format you can easily grok. I have a private repo on my home NAS that I can get to from anywhere. I have a chroot on android; all of those utilities exist natively on Win/Mac/Linux. Because I trust gpg enough, I could even use a free private repo on bitbucket. Just transfer your password encryption subkey around safely. There are various clients/guis out there including supposedly iOS and Firefox. It wouldn't be hard to write one for Android given all the pieces exist separately in open source forms. On Nov 16, 2014 4:58 AM, "Frank Sweetser" <fs(a)wpi.edu> wrote: > > Nice! The last time I looked, there were some issues with just dumping the > database file on Google drive, so it sounds like they've made some progress > since then. I'll check it out. > > Frank Sweetser fs at wpi.edu | For every problem, there is a solution > that > Manager of Network Operations | is simple, elegant, and wrong. > Worcester Polytechnic Institute | - HL Mencken > > On 11/15/2014 9:05 PM, Richard Klein wrote: > > Frank, > > You just save your .kdb (or is it .kdbx?) file on Google Drive. > It's just > > a file that you open and save from KeePass, so KeePass doesn't have to > support > > Google Drive per se. > > > > I used KeePass for a while, but I prefer LastPass. You said you > didn't > > want an app-specific cloud solution, so I guess that rules out LastPass, > but > > it's what I like. I also pay something like $12/year to LastPass, but > it's > > worth it. > > > > On Sat, Nov 15, 2014 at 6:28 PM, Frank Sweetser <fs(a)wpi.edu > > <mailto:fs@wpi.edu>> wrote: > > > > Any suggestion for any of the android app variants/clones to try? The > > couple that I looked at only claim Dropbox support, not google drive. > > > > > > On November 15, 2014 6:25:58 PM EST, JeffA Maillists > > <jeffa.maillists(a)gmail.com <mailto:jeffa.maillists@gmail.com>> > wrote: > > > > KeePass is awesome... ;-) > > > > On Nov 15, 2014 6:22 PM, "Frank Sweetser" <fs(a)wpi.edu > > <mailto:fs@wpi.edu>> wrote: > > > > Hey all, > > > > I'm looking to overhaul my password management, so I'm > looking for > > suggestions on what apps people are using. My ideal system > would > > have at least these features: > > > > - cross platform on windows, Linux, and android > > - synchronize via 3rd party cloud storage, preferably google > drive > > - *not* via an app specific service > > - good Firefox plugin > > > > Any suggestions on what to try, or to avoid, would be greatly > > appreciated. Thanks all! > > -- > > Sent from my Android device with K-9 Mail. Please excuse my > brevity. > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > > http://mail.wlug.org/mailman/listinfo/wlug > > > > > ------------------------------------------------------------------------------ > > > > Wlug mailing list > > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > > http://mail.wlug.org/mailman/listinfo/wlug > > > > > > -- > > Sent from my Android device with K-9 Mail. Please excuse my brevity. > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > > http://mail.wlug.org/mailman/listinfo/wlug > > > > > > > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org > > http://mail.wlug.org/mailman/listinfo/wlug > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Nov. 16, 2014

Re: [Wlug] Cross platform password management

by Frank Sweetser

Nice! The last time I looked, there were some issues with just dumping the database file on Google drive, so it sounds like they've made some progress since then. I'll check it out. Frank Sweetser fs at wpi.edu | For every problem, there is a solution that Manager of Network Operations | is simple, elegant, and wrong. Worcester Polytechnic Institute | - HL Mencken On 11/15/2014 9:05 PM, Richard Klein wrote: > Frank, > You just save your .kdb (or is it .kdbx?) file on Google Drive. It's just > a file that you open and save from KeePass, so KeePass doesn't have to support > Google Drive per se. > > I used KeePass for a while, but I prefer LastPass. You said you didn't > want an app-specific cloud solution, so I guess that rules out LastPass, but > it's what I like. I also pay something like $12/year to LastPass, but it's > worth it. > > On Sat, Nov 15, 2014 at 6:28 PM, Frank Sweetser <fs(a)wpi.edu > <mailto:fs@wpi.edu>> wrote: > > Any suggestion for any of the android app variants/clones to try? The > couple that I looked at only claim Dropbox support, not google drive. > > > On November 15, 2014 6:25:58 PM EST, JeffA Maillists > <jeffa.maillists(a)gmail.com <mailto:jeffa.maillists@gmail.com>> wrote: > > KeePass is awesome... ;-) > > On Nov 15, 2014 6:22 PM, "Frank Sweetser" <fs(a)wpi.edu > <mailto:fs@wpi.edu>> wrote: > > Hey all, > > I'm looking to overhaul my password management, so I'm looking for > suggestions on what apps people are using. My ideal system would > have at least these features: > > - cross platform on windows, Linux, and android > - synchronize via 3rd party cloud storage, preferably google drive > - *not* via an app specific service > - good Firefox plugin > > Any suggestions on what to try, or to avoid, would be greatly > appreciated. Thanks all! > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > http://mail.wlug.org/mailman/listinfo/wlug > > ------------------------------------------------------------------------------ > > Wlug mailing list > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > http://mail.wlug.org/mailman/listinfo/wlug > > > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > http://mail.wlug.org/mailman/listinfo/wlug > > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Nov. 16, 2014

Re: [Wlug] Cross platform password management

by Frank Sweetser

So my scenario is that (like many others) I have multiple devices I want to access the data from. In my case I primarily use a linux desktop, and windows laptop, and android phone. The simplest case, SSH'ing in, might be how I go, but it's way low on the usability scale compared to a nicely designed app, especially on android where SSH is a last resort without a decent hardware keyboard. I actually prefer Google over a storage backend that's tightly coupled with the app, for the simple reason that it prevents any chance of the backend storage location having any privileged access to the data. Google (or dropbox, or whatever) is just a dumb bag of bytes, so there's no risk of a hushmail style exploit: http://www.wired.com/2007/11/encrypted-e-mai/ (Not that I'm worried about the Feds, the possibility of server side encryption in the workflow makes things a little too tempting for hackers IMHO.) Once the data is assumed to be reasonably secure (where "reasonable" of course depends on the exact credentials stored), letting the already-secured data hang out on Google drive is a decent trade off in security vs usability. Long term I've considered setting up OwnCloud on my box at home, but that's not something I have time to play with right now... Frank Sweetser fs at wpi.edu | For every problem, there is a solution that Manager of Network Operations | is simple, elegant, and wrong. Worcester Polytechnic Institute | - HL Mencken On 11/15/2014 9:28 PM, Chris Thompson wrote: > FWIW, +1 for LastPass, though as stated, it does not suit your purposes (both > the Chrome and FF plugins are just dandy, a nod to the FF one though). > > BTW, why the tendency to want to give yet more data to Google? Personally, I'm > with Chuck - this data does NOT belong on the cloud, period. Unfortunately > I've (so far) failed to organize myself well enough to keep the data outside > of the cloud and also accessible [at least without using my own chosen methods > of encumbrance on the data], so, LastPass it is for now, for me anyway. > > Related question: personal cloud/data access solutions? I'm guessing the > preference here is a replicate-with-a-friend(s) personal encrypted storage > system and CLI/SSH access to such storage. > > Best of luck! > --Chris > > On Sat, Nov 15, 2014 at 9:19 PM, thinkbrown(a)gmail.com > <mailto:thinkbrown@gmail.com> <thinkbrown(a)gmail.com > <mailto:thinkbrown@gmail.com>> wrote: > > A text file in a TrueCrypt container? > > Logan > > On Nov 15, 2014 6:22 PM, "Frank Sweetser" <fs(a)wpi.edu <mailto:fs@wpi.edu>> > wrote: > > Hey all, > > I'm looking to overhaul my password management, so I'm looking for > suggestions on what apps people are using. My ideal system would have > at least these features: > > - cross platform on windows, Linux, and android > - synchronize via 3rd party cloud storage, preferably google drive - > *not* via an app specific service > - good Firefox plugin > > Any suggestions on what to try, or to avoid, would be greatly > appreciated. Thanks all! > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > http://mail.wlug.org/mailman/listinfo/wlug > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org <mailto:Wlug@mail.wlug.org> > http://mail.wlug.org/mailman/listinfo/wlug > > > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Nov. 16, 2014

Re: [Wlug] Cross platform password management

by Chris Thompson

FWIW, +1 for LastPass, though as stated, it does not suit your purposes (both the Chrome and FF plugins are just dandy, a nod to the FF one though). BTW, why the tendency to want to give yet more data to Google? Personally, I'm with Chuck - this data does NOT belong on the cloud, period. Unfortunately I've (so far) failed to organize myself well enough to keep the data outside of the cloud and also accessible [at least without using my own chosen methods of encumbrance on the data], so, LastPass it is for now, for me anyway. Related question: personal cloud/data access solutions? I'm guessing the preference here is a replicate-with-a-friend(s) personal encrypted storage system and CLI/SSH access to such storage. Best of luck! --Chris On Sat, Nov 15, 2014 at 9:19 PM, thinkbrown(a)gmail.com <thinkbrown(a)gmail.com> wrote: > A text file in a TrueCrypt container? > > Logan > On Nov 15, 2014 6:22 PM, "Frank Sweetser" <fs(a)wpi.edu> wrote: > >> Hey all, >> >> I'm looking to overhaul my password management, so I'm looking for >> suggestions on what apps people are using. My ideal system would have at >> least these features: >> >> - cross platform on windows, Linux, and android >> - synchronize via 3rd party cloud storage, preferably google drive - >> *not* via an app specific service >> - good Firefox plugin >> >> Any suggestions on what to try, or to avoid, would be greatly >> appreciated. Thanks all! >> -- >> Sent from my Android device with K-9 Mail. Please excuse my brevity. >> _______________________________________________ >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug >> >> > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Nov. 16, 2014

Re: [Wlug] Cross platform password management

by thinkbrown＠gmail.com

A text file in a TrueCrypt container? Logan On Nov 15, 2014 6:22 PM, "Frank Sweetser" <fs(a)wpi.edu> wrote: > Hey all, > > I'm looking to overhaul my password management, so I'm looking for > suggestions on what apps people are using. My ideal system would have at > least these features: > > - cross platform on windows, Linux, and android > - synchronize via 3rd party cloud storage, preferably google drive - *not* > via an app specific service > - good Firefox plugin > > Any suggestions on what to try, or to avoid, would be greatly appreciated. > Thanks all! > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Nov. 16, 2014

Re: [Wlug] Cross platform password management

by Richard Klein

Frank, You just save your .kdb (or is it .kdbx?) file on Google Drive. It's just a file that you open and save from KeePass, so KeePass doesn't have to support Google Drive per se. I used KeePass for a while, but I prefer LastPass. You said you didn't want an app-specific cloud solution, so I guess that rules out LastPass, but it's what I like. I also pay something like $12/year to LastPass, but it's worth it. On Sat, Nov 15, 2014 at 6:28 PM, Frank Sweetser <fs(a)wpi.edu> wrote: > Any suggestion for any of the android app variants/clones to try? The > couple that I looked at only claim Dropbox support, not google drive. > > > On November 15, 2014 6:25:58 PM EST, JeffA Maillists < > jeffa.maillists(a)gmail.com> wrote: >> >> KeePass is awesome... ;-) >> On Nov 15, 2014 6:22 PM, "Frank Sweetser" <fs(a)wpi.edu> wrote: >> >>> Hey all, >>> >>> I'm looking to overhaul my password management, so I'm looking for >>> suggestions on what apps people are using. My ideal system would have at >>> least these features: >>> >>> - cross platform on windows, Linux, and android >>> - synchronize via 3rd party cloud storage, preferably google drive - >>> *not* via an app specific service >>> - good Firefox plugin >>> >>> Any suggestions on what to try, or to avoid, would be greatly >>> appreciated. Thanks all! >>> -- >>> Sent from my Android device with K-9 Mail. Please excuse my brevity. >>> _______________________________________________ >>> Wlug mailing list >>> Wlug(a)mail.wlug.org >>> http://mail.wlug.org/mailman/listinfo/wlug >>> >>> ------------------------------ >> >> Wlug mailing list >> Wlug(a)mail.wlug.org >> http://mail.wlug.org/mailman/listinfo/wlug >> >> > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Nov. 16, 2014

Re: [Wlug] Cross platform password management

by Chuck Anderson

I like keepassx because there is a CLI "shell" client I'm using called kpcli. I use both the GUI and CLI in different scenarios. I have the Android client as well, but don't really use it. Instead I SSH in and use kpcli. I prefer to keep my data local (not in the cloud), especially sensitive data like password databases. On Sat, Nov 15, 2014 at 06:21:32PM -0500, Frank Sweetser wrote: > Hey all, > > I'm looking to overhaul my password management, so I'm looking for suggestions on what apps people are using. My ideal system would have at least these features: > > - cross platform on windows, Linux, and android > - synchronize via 3rd party cloud storage, preferably google drive - *not* via an app specific service > - good Firefox plugin > > Any suggestions on what to try, or to avoid, would be greatly appreciated. Thanks all!

Nov. 16, 2014