4

I'm having to handle several VPS/services and I always set passwords to be different and random.

What kind of storage do you suggest to keep these passwords safe and let me access them easily?

These passwords are used for services like databases, webserver user and so on that run customers' services, so it's really important to keep them in a safe place and strong. I'm actually storing them in a google drive spreadsheet file, describing user, password, role, service.

Do you know of better solutions? I'd like to keep them on a remote service to make sure I don't have to make backup copies (in case my hdd would fail somehow).

I do work on *nix platforms (so windows specific solutions are not a choice here).

4
  • Look up the description of a 'eWallet'
    – Hennes
    Sep 3, 2012 at 12:53
  • 3
    Don't store your passwords on the cloud. EVER. That's dangerous in my opinion (others may disagree), no matter what anyone says, and no matter how secure a cloud service says it is, in my opinion it should never be done. Do a search for "Password Manager"... you have options.
    – David W
    Sep 3, 2012 at 13:08
  • Mat Honan for one probably wouldn't. I second the suggestion of using a (local) password manager. Sep 3, 2012 at 13:22
  • @DavidW lastpass.com
    – TheLQ
    Sep 7, 2012 at 3:35

3 Answers 3

5

You can use keepass for this it has Linux and Windows application also Android one.

You can have your passwords in keepass encrypted with password and key file, have the key file on all your devices and the encrypted database (without the keyfile) on DropBox.

This way you can acces it from anywhere, because the encrypted database are stored in the cloud but without the keyfile. I think it is safe enough.

4
  • I used keepass for a long time. It's a bit awkward to use, but it did the trick. Once I had a need to share passwords with others I switched to LastPass.
    – blueben
    Sep 3, 2012 at 20:15
  • @blueben how was it awkward? Pretty basic Explorer-like interface, cross-platform. I can't even think of how I'd make it better to be honest.
    – gravyface
    Sep 3, 2012 at 20:37
  • The UI itself is a bit clumsy, and I found I always had to have it open which clutters my desktop. When you have hundreds of credentials, it can be a bit difficult to search. The alternative is to group things aggressively, but you still have the search problem to deal with and grouping adds more clicks. Moreso, now that I have used browser-based systems (where most of my password use occurs), flipping to another app to cut and paste a password just to log in to a website turns out to be a big pain.
    – blueben
    Sep 3, 2012 at 20:54
  • KeePass2 + Dropbox is what I use. Would be surprised if there was anything easier. spreadsheet at docs.google.com + Google Drive (Since you get a document in your drive for that spreadsheet) might be another option for simplicity. I use the Google Drive option for purchased registered keys for stuff I own and need to install on occasion, although I'll probably migrate the stuff to KeePass at some point.
    – WernerCD
    Sep 3, 2012 at 23:32
2

You should definitely note store them in the clear on the cloud. That's just asking for trouble!

What you can do is encrypt them yourself and then keep a copy of the encrypted file in the cloud. That way, assuming you have not used a bad password for the encryption, your passwords are securely stored off-site.

You could do this manually with a text file saved inside a TrueCrypt vault that you keep on DropBox or something. But that would not really be that easy.

Instead, you could use a password manager that will do this for you. There are password managers that will save your password in encrypted form, and then sync this encrypted file between your devices. An example of a password manager that can do this for you would be 1Password.

Ultimately, the key is pre-egress encryption - i.e. it needs to be encrypted before it leaves your computer, do not rely on cloud security to keep your critical data safe, encrypt it yourself first.

2

In addition to the aforementioned keepass (or keepassx on Unix derivatives), I have found that folks are fans of LastPass and 1Password. I prefer and use LastPass because it has Linux support, encryption happens on the client, the UI integrates very well with the browser, and they have YubiKey support. Because the built-in password generation and storage is so easy to use, I have 12 to 20+ character random alpha-numeric-symbol passwords for hundreds of accounts.

1
  • Another fan of 'password manager' type solutions here. I've used a few and settled on lastpass, which has a lot going for it. Why make life difficult for yourself?
    – Rob Moir
    Sep 3, 2012 at 20:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .