keepass 2 password generator

gareth170 · 2 Sep 2013 at 19:34

hi

i would like to know is the keepass 2 password generator safe / good to use on all my website accounts and gaming accounts/clients?

gareth170 · 3 Sep 2013 at 14:00

free lastpass doesn't do windows GUI programs? keepass 2 does

gareth170 · 3 Sep 2013 at 22:07

which is better lastpass or Keepass?

gareth170 · 4 Sep 2013 at 11:34

so with LastPass is the database store on the local HDD or online?

gareth170 · 4 Sep 2013 at 16:27

that my worry, LastPass stores the database online and theres no way of knowing if they access it or if the server gets hacked.

gareth170 · 5 Sep 2013 at 15:24

KIA said:
Use a strong master password.

how strong? how many bits?

problem is i don't want to write down a long password and having to ask someone to get it everytime i want to login to something

i would be using a key file aswell on keepass which adds security.

gareth170 · 5 Sep 2013 at 18:57

KIA said:
As many as you can manage. I aim for greater than 90.

Key file is useful when it comes to syncing the database. The database is the only file that needs to be synced. For increased security, you could put the key file on a removal USB drive and only insert it when you need access to the database.

i could put the database on my 4TB NAS that way it'll be accessible to my devices but not to the internet. is that better idea.

i got to about 107 bits

gareth170 · 5 Sep 2013 at 20:27

i mainly only need it for my pc and laptop, I have the internet access feature disabled on my NAS so only devices on my private network can access it.

gareth170 · 6 Sep 2013 at 12:17

CaptainCrash said:
My LastPass master password is 26 characters.

It's not completely random, but there's enough randomness and non-obvious substitutions to make it pretty safe - according to my1login, it would take 2 hundred trillion years to crack it, which is well into the Universe's degenerate era. I doubt if even Nelson Mandela will be around by then.

tbh I wouldn't of put your real password on that site to check.

gareth170 · 7 Sep 2013 at 10:39

KIA said:
Sounds good. Don't forget to create a backup of the database on a regular basis, just in case.

well my NAS automaticly makes a second copy of everything.

is it more secure if i use the hidden option and/or put the database in a rar file which has a large file in it that way "if" anyone trys to get it from my pc they would have to download a big file (upload from my pc) and i would easyly know by if the speed drops

gareth170 · 7 Sep 2013 at 13:47

KIA said:
Sounds like a lot of hassle to me. The attacker could extract the archive to get the database.

ok i'll just see how it goes has it is. i've done 4 passwords so far

i don't download any doggy things anyway.

could i keep the flash drive pluged in but disabled it in device manager after finishing with keepass? or still best to unplug it?

gareth170 · 7 Sep 2013 at 18:45

KIA said:
I would remove it. What's on the flash drive, the key file?

yes. the reason i asked is because if i'm alone or something and need to login to something, i wouldn't able too, has i can't plug in the flash drive myself.

dLockers said:
If you're referring to the NAS' RAID capability, this isn't a backup - make sure you do backups as well.

RAID 1 mirrors the data so if one HDD dies/fails the data is still safe/accessible on the other hdd.

also i normally do a safepoint which it backups everything to a external hdd

gareth170 · 7 Sep 2013 at 22:29

KIA said:
Disabling the device would be best in this case, if you're willing to enable/disable every time to want to access the database. You could use a Truecrypt container instead of a flash drive.

ok, thanks

Anon-e-mouse said:
I personally wouldn't use Lastpass.. Not because it's bad, but because your passwords are not stored on your PC, and are therefore NOT under YOUR control.

You are dependant on the Lastpass server not being compromised (from any source)... and in this day/age when it's well known that the NSA are busy decrypting ANYTHING they can access, the VERY LAST place I would put my passwords is online.

Now admittedly I might be biased because I am a Keepass user. However in this day/age the very last place I would put anything sensitive is online, on a server outside of my control.

YMMV

i agree. that why i don't like the idea of lastpass

gareth170 · 9 Sep 2013 at 10:41

Halfmad said:
RAID 1 isn't a backup, far too often I've seen one drive go and the other get corrupt garbage dumped on it. Please for the love of god do your external backup regularly

if thats the case why don't i just run raid 0 has theres still a risk?

u have to remember it's much more difficult for me to do things like this (pluging / unpluging usb's) has i have to relay on someone to do that for me.

gareth170 · 11 Sep 2013 at 16:45

KIA said:
@gareth170 You should use an online backup service. Plenty of "trust no one" solutions exist.

http://www.duplicati.com/ (this needs somewhere to backup to)
http://www.carbonite.com/
http://www.crashplan.com/

i have virgin media unlimited backup space but it's so slow, i have over 20GB of photos and it's taken 3 days so far, it's only uploading @ 816Kb/s

gareth170 · 11 Sep 2013 at 19:07

KIA said:
Are you using the web interface or the client?

using the client

the web interface only allow 3 files to be uploaded at a time