2

I use a mac (though this is not critical to the question, it has some relevance)

Every time I have to choose a password, I make a plain text with name of the website, username, and password in it.

Then store it in a single directory.

The directory though is not accessible by everyone, but it is encrypted (basically I created a .dmg file that requires a password to be opened). The "master password" itself is not stored anywhere and I remember it.

Is this a bad habit?

What do services like OnePassword offer more?

EDIT

I would like to know a little more so I would be grateful if you could go beyond the "Yes - No" answers :-)

2 Answers 2

3

The .DMG file is encrypted with AES, while the Apple Keychain is encrpyted using Triple DES. Based off this answer on StackOverflow, either the method you're currently using or the Keychain is fine, but the .DMG method would actually be preferable.

Personally I would prefer the ease of use of the Keychain or a 3rd party app like KeePass2 but your method is a strong enough method of encryption that you shouldn't have any issues.

3
  • Thank you for your answer! So if I'm willing to do that "by hand", it is the same thing than using OnePassword or similar services?
    – Ant
    Apr 9, 2014 at 18:03
  • @Ant It depends, because I'm not sure every single on of those services uses the same type of encryption, but 1Password uses AES, which is the same as your DMG file. KeePass uses AES and Twofish.
    – user201262
    Apr 9, 2014 at 18:04
  • 1
    I'd argue that the encryption used (AES vs. 3DES) isn't as important as things like password choice, key management, etc. If someone steals your passwords it won't be because they broke AES or 3DES, it'll be because they guessed the password, or you forgot to dismount the disk image, or... Apr 10, 2014 at 16:10
2

This is definitely a bad habit. If you are using a Mac, I believe you can store all of those website logins by using the "Keychain" app.

Also, if you don't want to use the Keychain app, you should be using your web browser to store those passwords. They are encrypted when saved to the hard disk.

7
  • Why is a bad habit? Can the file be compromised more easily than keychain or webbrowser? I believe they are encrypted with AES.. Anyhow, How am I supposed to retrieve my password from the webbrowser if the computer breaks? And how is OnePassword different than doing that?
    – Ant
    Apr 9, 2014 at 17:08
  • It is a bad habit because in the case that someone was able to gain unauthorized access to your computer (i.e. Remote Control, Physically sitting at your computer, etc...), they will have free reign to retrieve any file they want. The text file is in plain text but the keychain and web browser files are encrypted with a hash. Depending on what browser you use, it may actually link your saved passwords to your account, so in the event of a failure, you can access them after fixing your computer.
    – byachna
    Apr 9, 2014 at 17:12
  • Also, if you do not want to go the route of saving your passwords in the Keychain / Web browser, you could always download a third-party encryption tool to encrypt your password file. Then, if you ever need to access that file, you can.
    – byachna
    Apr 9, 2014 at 17:14
  • Sorry for the chain comments! :)
    – byachna
    Apr 9, 2014 at 17:15
  • Dont worry about that :-) Yes the files are in plain text but those files are inside a .dmg file which is encrypted, if someone were to gain access to my computer (or to my file) would they be able to crack that more easily than keychain?
    – Ant
    Apr 9, 2014 at 17:17

Not the answer you're looking for? Browse other questions tagged .