Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use a mac (though this is not critical to the question, it has some relevance)

Every time I have to choose a password, I make a plain text with name of the website, username, and password in it.

Then store it in a single directory.

The directory though is not accessible by everyone, but it is encrypted (basically I created a .dmg file that requires a password to be opened). The "master password" itself is not stored anywhere and I remember it.

Is this a bad habit?

What do services like OnePassword offer more?


I would like to know a little more so I would be grateful if you could go beyond the "Yes - No" answers :-)

share|improve this question

closed as primarily opinion-based by Ƭᴇcʜιᴇ007, Raystafarian, Tog, soandos, harrymc May 23 '14 at 6:56

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 3 down vote accepted

The .DMG file is encrypted with AES, while the Apple Keychain is encrpyted using Triple DES. Based off this answer on StackOverflow, either the method you're currently using or the Keychain is fine, but the .DMG method would actually be preferable.

Personally I would prefer the ease of use of the Keychain or a 3rd party app like KeePass2 but your method is a strong enough method of encryption that you shouldn't have any issues.

share|improve this answer
Thanks for digging into this more Moses! – byachna Apr 9 '14 at 17:51
Thank you for your answer! So if I'm willing to do that "by hand", it is the same thing than using OnePassword or similar services? – Ant Apr 9 '14 at 18:03
@Ant It depends, because I'm not sure every single on of those services uses the same type of encryption, but 1Password uses AES, which is the same as your DMG file. KeePass uses AES and Twofish. – Moses Apr 9 '14 at 18:04
Perfect. Thanks for the answer! :) – Ant Apr 9 '14 at 18:08
I'd argue that the encryption used (AES vs. 3DES) isn't as important as things like password choice, key management, etc. If someone steals your passwords it won't be because they broke AES or 3DES, it'll be because they guessed the password, or you forgot to dismount the disk image, or... – Gordon Davisson Apr 10 '14 at 16:10

This is definitely a bad habit. If you are using a Mac, I believe you can store all of those website logins by using the "Keychain" app.

Also, if you don't want to use the Keychain app, you should be using your web browser to store those passwords. They are encrypted when saved to the hard disk.

share|improve this answer
Why is a bad habit? Can the file be compromised more easily than keychain or webbrowser? I believe they are encrypted with AES.. Anyhow, How am I supposed to retrieve my password from the webbrowser if the computer breaks? And how is OnePassword different than doing that? – Ant Apr 9 '14 at 17:08
It is a bad habit because in the case that someone was able to gain unauthorized access to your computer (i.e. Remote Control, Physically sitting at your computer, etc...), they will have free reign to retrieve any file they want. The text file is in plain text but the keychain and web browser files are encrypted with a hash. Depending on what browser you use, it may actually link your saved passwords to your account, so in the event of a failure, you can access them after fixing your computer. – byachna Apr 9 '14 at 17:12
Also, if you do not want to go the route of saving your passwords in the Keychain / Web browser, you could always download a third-party encryption tool to encrypt your password file. Then, if you ever need to access that file, you can. – byachna Apr 9 '14 at 17:14
Sorry for the chain comments! :) – byachna Apr 9 '14 at 17:15
Dont worry about that :-) Yes the files are in plain text but those files are inside a .dmg file which is encrypted, if someone were to gain access to my computer (or to my file) would they be able to crack that more easily than keychain? – Ant Apr 9 '14 at 17:17

I think it is a bad habit. There are a number of programs that save all your passwords encrypted. Also, you could write in papers this passwords, and save it in a locker. It would be more secure.

Even if your computer is not not compromised (no one is hacking it), sometime a unpolite guest could search your files and see your passwords.

share|improve this answer
thanks for the answer but, once again, the files are in an encrypted .dmg file. – Ant Apr 9 '14 at 18:02

Not the answer you're looking for? Browse other questions tagged .