I use a self-made password manager that generates strong passwords based on one strong key and easily rememberable strings for each website/account. The basic principle can be most easily conveyed by pseudocode:

key = raw_input("Enter key: ")
url = raw_input("Enter URL: ") // like jons3.serverfault or something similar easily rememberable
pw = sha512(key + url)
pw = base64_encode(pw)
pw = pw[0:16] 
print pw   % or set the clipboard, etc., etc.

Now I am considering implementing some additional features:

  • Advanced password management. I.e. I don't need to enter the key itself, it resides on the hdd in an encrypted form, so I only need to input some easier password to decrypt it. A possibility to have multiple passwords that can decrypt the same key. A possibility to have one-time passwords. A possibility to have several keys. Etc.
  • Capability to run the manager as a daemon on a server.
  • Multi-platform clients that can talk to the server.

Being lazy, I hope that someone has already implemented the concept and at least some of the desired features. Does anyone know such password manager?

  • 3
    What exactly is your question? Product suggestions are not on topic for Stack Exchange websites. I hope you understand the method your using to secure your password is not secure. KeePass already exists and allows the use of a key file. – Ramhound Jan 3 '13 at 15:32
  • I'm looking for an open source component of some sort. Didn't know su such were forbidden, I see quite a lot of similar posts. Why is my method insecure? Could you elaborate? Keepass and similar are not an option because they are susceptible to password database loss. – jons34yp Jan 3 '13 at 15:36
  • There are theoretical possible ways to attack SHA512. If you are dealing with passwords, the Blowfish password specific BCRYPT algorithm should be used on several thousand iteration cycle. As for the additional clarification I can't stop thinking asking for such a component is unlikely to be on topic for Super User. – Ramhound Jan 3 '13 at 15:47
  • Don't limit your password to 16 chars – Jan Doggen Jan 7 '13 at 12:32
  • Any password manager that doesn't require a database suffers from a severe flaw: If you want to change a single password (including the master password), you have to change all passwords. – Dennis Jan 17 '13 at 22:17

As has been mentioned Keepass is probably the most popular open source password manager. I like Lastpass (not open). If you want more to look at, you can always see what Steve Gibson has to say at GRC.com or Listen to him at Security Now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.