Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
View Poll Results: Password management - how do you do it?
One password for everything
6
8.82%
I have a limited list of passwords from which I choose when need arises
44
64.71%
For each new occasion I generate a totally new password
One rather annoying "feature" of what I believe to be a flawed security model are the work related passwords that have to be changed every 90 days. It invites weak passwords and writing them down..
Exactly! And on top of that, they always seem to expire when you want to "real quick just login" and do something simple.
PassReminder, which works on Linux and Windows. However, after reading the previous posts I'm starting to think this might not be secure enough.
My passwords are combinations of a few basic strings, which I join according to the nature of the site/program/domain I am using.
Can I have some of your brain cells pls...I live in Australia and mine have leaked out over the years.
To anyone
I use a acronym system....of some line or whatever eg
you may secretly like a line in a movie like
Give the bag to Bozo.
acronym it becomes gtbtb...add some extra characters and numbers.
It should not be something you repeat to people....like if I always say ....cheerio and may linux bless you (puke)...it can not be based on that...but something secret.....a man secret would do.
I use a acronym system....of some line or whatever eg
I use something similar except that mine are derived from phrases that depict my mood at the time and then I exchange the letters for special characters/numbers. Not a bad system since I only have to remember a phrase, but the fun part comes in trying to remember which symbols I used...
I have a "standard" prefix to my password that I use in many places, then change either the beginning or end few characters depending upon what I am using it for.
Distribution: openSuSE Tumbleweed-KDE, Mint 21, MX-21, Manjaro
Posts: 4,629
Rep:
Quote:
Originally Posted by KenJackson
"linuxques" is just an example, which would happen to work for the LinuxQuestions.org website, on which we sit.
I don't get the mechanism. How is that realized in your bash script, or is it intrinsic in the password file ... but I still don't get the connection .
Quote:
Originally Posted by KenJackson
Why not use Kwallet? Why not use what I want? My system works perfectly for me.
My, aren't we touchy . I just asked out of curiosity, no criticism intended. After all, you took the pains to create your own solution, I just wanted to know what made you decline the use of a prefabbed one like Kwallet.
I don't get the mechanism. How is that realized in your bash script, or is it intrinsic in the password file ... but I still don't get the connection .
The plaintext format of the encrypted file is something like this:
linuxquestions.org username password
So when my function unencrypts the file and greps it, the argument "linuxques" catches that line and spits it out, but is unlikely to match any other entry.
As a bonus, if I'm looking for some site I know I've been on but can't remember, I can grep for some small part of it and I get all the sites that match.
I keep a few in my head. I'm a big fan of passphrases - it gets me a long (and thus secure) phrase with minimal effort on my part. I realize that basing it upon dictionary words weakens it a bit, but not so much that being 2-3 longer won't compensate I don't think :-). The exception is my banking/credit card passwords. These are all at least 12 characters long and fully randomly generated for utmost security. No way I'm going to remember them. I used Password Gorilla for some time, mostly because it allowed me to (via ntfs-3g or extfs at my option) use the same password file between both sides of my XP/lenny dual boot. Recently, I moved off of Password Gorilla. It makes me slightly nervous that the last release was in '06, and it's holding my most sensitive data. Also, usage of the XP side of my dual boot atrophied so significantly that compatibility became a non-issue. When I'm on the go, I use whatever password manager is in the Maemo repos for my n800. Perhaps its from GPE?
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.