Schadenfreude » passwords

KeePassX: The Perfect Password App

Erik — Sun, 16 Oct 2011 17:30:46 +0000

Recently, I’ve been having some trouble with passwords. Either the login name is a string I never use, and therefore never commit to memory (like my real phone number that I mask with Google Voice), or the password policy forces me to use a password that I’ll never remember (like sites that keep track of your past passwords, or require 11 characters of alternating symbols, letters and numbers, etc.). Since I use spamgourmet, any site that requires an email address as a username is another puzzle – sometimes I even have to login there to find the right one. Also, I have a concern that if I die, my wife will have real trouble getting into all my accounts, so it would be nice if I could just leave her one password to give her access to all that information. So, I broke down and started using a password organizer app. Now, I have always been averse to using these applications for a variety of reasons (online companies having all your passwords, plaintext in swap space / memory, keyloggers, insecure encryption, etc.), but I managed to find one that’s open source, never caches my master password, widely used, and has extreme cross-platform capabilities. KeePassX is the name, and it’s available in Ubuntu. Installing it is left as an exercise to the reader. Once you get in there and add a few passwords, it starts to look something like this:

It allows you to mask both your usernames and passwords (both optionally) from the top-level view. It has clipboard capabilities, so you can just copy your password to the clipboard by clicking a button, and never see it on the screen in plain-text. Their security is really well-done. But the big realization today was that they have an Android App! This app only need the kdb file from any instance of the application, and of course the password to decrypt it. It’s available in the market too! But, how do you sync changes between your main desktop and your phone? Dropbox! Using the dropbox mobile app, I simply synced the kdb file onto the phone, and then opened it. KeePassDroid popped up and asked if I wanted to make it the default database, and I checked the box. Done.

Now, whenever I make a change, it syncs over Dropbox like magic.

Good Passwords with GnuPG

Erik — Sun, 23 Aug 2009 03:15:45 +0000

I found out from this site that GPG can be used to generate random text for passwords. Here’s the command:


 gpg --gen-random 1 20 | gpg --enarmor | sed -n 5p

Very simple. I may have to use this in the future.

WARNING

This limits you to the Base64 character set, greatly limiting the search space for password cracking. One should really use something other than enarmor to spit out a random printable ASCII string…

Update

OK, I did it. It took some time, but it works nicely now, and generates MUCH better passwords:


hank@tardis:/nexus/tardis/hank$ for i in 1 2 3 4; \
  do gpg --gen-random 1 20 | \
  perl -ne's/[\x00-\x20]/chr(ord($^N)+50)/ge;s/([\x7E-\xDB])/chr(ord($^N)-93)/ge;s/([\xDC-\xFF])/chr(ord($^N)-129)/ge;print $_, "\n"';
done
p8$K`frjdkp;i-c2]2a2
glj#""I/eY\aYe3p}2y@
U2cXL&2^2/@7P2d#;?E=
kG)|N?[ZP2t2'bH22e;$

I know that probably looks like gobbledy-gook, but the main part of it is this:

gpg --gen-random 1 20 | perl -ne'print "Your password: ";s/[\x00-\x20]/chr(ord($^N)+50)/ge;s/([\x7E-\xDB])/chr(ord($^N)-93)/ge;s/([\xDC-\xFF])/chr(ord($^N)-129)/ge;print $_, "\n"'

Run that in a terminal, and profit.

Horray for pwgen

Erik — Sat, 04 Nov 2006 17:29:00 +0000

I wanted to generate a new password today and I decided I would try a command
line utility that does just that. It’s called pwgen.


hank@rura-penthe ~ $ sudo apt-get install pwgen
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  pwgen
0 upgraded, 1 newly installed, 0 to remove and 2 not upgraded.
Need to get 18.7kB of archives.
After unpacking 77.8kB of additional disk space will be used.
Get:1 http://ftp.osuosl.org edgy/main pwgen 2.05-1ubuntu1 [18.7kB]
Fetched 18.7kB in 0s (28.2kB/s)
Selecting previously deselected package pwgen.
(Reading database ... 173873 files and directories currently installed.)
Unpacking pwgen (from .../pwgen_2.05-1ubuntu1_i386.deb) ...
Setting up pwgen (2.05-1ubuntu1) ...

Now the fun begins.


hank@rura-penthe ~ $ pwgen -sy 16 10
YaQcm?3@Ty~c=U|$     cthv{@O*|X79&=k_     |Fr&PH#b2%.>}*Wo     rOtTfJ^.GP=l{L41
Wb?%i[42y'Q'pF+F     0M`N9{I:8;9Eii}<     *vP~-N,ofuIXE{`1     ^Rq[?xm#"\1EQ~wl
'I9JIktnw`bW@zH>     >/FD6+tdc;+SINHx

Now, I have a bunch of passwords to select from. -s gives me ‘secure’
passwords which are very hard to remember. Lucky for me I have a good memory
for hard to remember things (though things that are easy to remember escape
me). -y gives me symbols since a larger character set always enhances a
password. Now, I’m all set to do battle.