3

I use a self-made password manager that generates strong passwords based on one strong key and easily rememberable strings for each website/account. The basic principle can be most easily conveyed by pseudocode:

key = raw_input("Enter key: ")
url = raw_input("Enter URL: ") // like jons3.serverfault or something similar easily rememberable
pw = sha512(key + url)
pw = base64_encode(pw)
pw = pw[0:16] 
print pw   % or set the clipboard, etc., etc.

Now I am considering implementing some additional features:

  • Advanced password management. I.e. I don't need to enter the key itself, it resides on the hdd in an encrypted form, so I only need to input some easier password to decrypt it. A possibility to have multiple passwords that can decrypt the same key. A possibility to have one-time passwords. A possibility to have several keys. Etc.
  • Capability to run the manager as a daemon on a server.
  • Multi-platform clients that can talk to the server.

Being lazy, I hope that someone has already implemented the concept and at least some of the desired features. Does anyone know such password manager?

Improve this question
8
  • 3
    What exactly is your question? Product suggestions are not on topic for Stack Exchange websites. I hope you understand the method your using to secure your password is not secure. KeePass already exists and allows the use of a key file.
    – Ramhound
    Jan 3, 2013 at 15:32
  • I'm looking for an open source component of some sort. Didn't know su such were forbidden, I see quite a lot of similar posts. Why is my method insecure? Could you elaborate? Keepass and similar are not an option because they are susceptible to password database loss.
    – jons34yp
    Jan 3, 2013 at 15:36
  • There are theoretical possible ways to attack SHA512. If you are dealing with passwords, the Blowfish password specific BCRYPT algorithm should be used on several thousand iteration cycle. As for the additional clarification I can't stop thinking asking for such a component is unlikely to be on topic for Super User.
    – Ramhound
    Jan 3, 2013 at 15:47
  • Don't limit your password to 16 chars
    – Jan Doggen
    Jan 7, 2013 at 12:32
  • Any password manager that doesn't require a database suffers from a severe flaw: If you want to change a single password (including the master password), you have to change all passwords.
    – Dennis
    Jan 17, 2013 at 22:17

1 Answer 1

Reset to default
0

As has been mentioned Keepass is probably the most popular open source password manager. I like Lastpass (not open). If you want more to look at, you can always see what Steve Gibson has to say at GRC.com or Listen to him at Security Now.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .