keepass 2 password generator

KIA · 5 Sep 2013 at 18:31

ooops double post.

gareth170 · 5 Sep 2013 at 18:57

KIA said:
As many as you can manage. I aim for greater than 90.

Key file is useful when it comes to syncing the database. The database is the only file that needs to be synced. For increased security, you could put the key file on a removal USB drive and only insert it when you need access to the database.

i could put the database on my 4TB NAS that way it'll be accessible to my devices but not to the internet. is that better idea.

i got to about 107 bits

Raumarik · 5 Sep 2013 at 20:15

Entirely dependent on whether you need access to it elsewhere or on mobile devices, chances are a large player like Lastpass will be able to secure it better than you and have more resilience than your home hosted NAS, but they're also a vastly bigger target for any attack away.

Swings and roundabouts really, I use Lastpass as I enjoy the paid for android app (all $12 a year or whatever) makes things a lot easier on the go.

peige · 5 Sep 2013 at 20:20

Following this thread I tried keepass, didn't really like it, felt clunky with its integration on firefox and having to keep the file and file access on all the computers that I use.

Then played with lastpass, like it much more. It integrates much better with firefox and works on my desktop, laptop and work pc without any faffing about. I've now subbed for a year.
Had a bit of a moment where I lost access to here when I generated a new password for these forums and then didn't click save! But looked back through the logs and found out it shows passwords recently generated so got back in tonight and saved it.

My only worry is dependance on the lastpass servers for all my passwords, if that went i'd have to go through every site and do a reset...

gareth170 · 5 Sep 2013 at 20:27

i mainly only need it for my pc and laptop, I have the internet access feature disabled on my NAS so only devices on my private network can access it.

CaptainCrash · 6 Sep 2013 at 00:11

peige said:
My only worry is dependance on the lastpass servers for all my passwords, if that went i'd have to go through every site and do a reset...

There's a local copy of the encrypted database stored in your browser profile*, so you should be OK even if LastPass's servers were to go down, but if you want to be doubly/triply sure you could manually export a backup using "Tools > Export To" every so often.

You can also access the database files completely independently of your browser using LastPass Pocket, which works very much like KeePass although without the bells and whistles of later versions.

*edit: my mistake, it's actually in C:\Users\%username%\AppData\LocalLow\LastPass, not the browser profile.

Craig321 · 6 Sep 2013 at 00:25

gareth170 said:
how strong? how many bits?

problem is i don't want to write down a long password and having to ask someone to get it everytime i want to login to something

i would be using a key file aswell on keepass which adds security.

Check here: https://www.grc.com/haystack.htm

Something as simple as Overcl0ckers! would take a "Massive Cracking Array (Assuming one hundred trillion guesses per second)" 1.65 hundred centuries to crack.

CaptainCrash · 6 Sep 2013 at 01:29

Craig321 said:
Check here: https://www.grc.com/haystack.htm

Something as simple as Overcl0ckers! would take a "Massive Cracking Array (Assuming one hundred trillion guesses per second)" 1.65 hundred centuries to crack.

I wouldn't rely on that too much - I think it's assuming a purely brute-force attack, and "Overcl0ckers!" isn't a truly random password. my1login reckons it's "medium" and would fall in 26 hours:

Hmm, using that password is like locking your front door, but leaving the key under the mat.
Your password is of medium strength because it contains 3 dictionary words.

This is quite an interesting read: http://www.dansdata.com/gz140.htm

bledd · 6 Sep 2013 at 07:29

I use keepass, I keep the db on my SkyDrive. That way, it's on all my machines

zenf · 6 Sep 2013 at 10:26

I've been using Keepass for a while now, it's brilliant for the most part but very annoying when certain sites or games don't let you copy and paste into the password field, like the other day when I was trying to login to Windows Live after installing GTA IV and kept having to tab out of the game. Worth it though.

Raumarik · 6 Sep 2013 at 10:49

CaptainCrash said:
I wouldn't rely on that too much - I think it's assuming a purely brute-force attack, and "Overcl0ckers!" isn't a truly random password. my1login reckons it's "medium" and would fall in 26 hours:

This is quite an interesting read: http://www.dansdata.com/gz140.htm

Meh dictionary based passwords are always daft. Mine are utterly random characters/letters/special characters which frankly make no sense and I can barely say them if I try. My Lastpass one is over 16 characters long, still no idea how I manage to remember it!

booyaka · 6 Sep 2013 at 11:31

keepass here - dropbox to sync across ipad/pc's and phone etc

CaptainCrash · 6 Sep 2013 at 12:09

Halfmad said:
My Lastpass one is over 16 characters long, still no idea how I manage to remember it!

My LastPass master password is 26 characters.

It's not completely random, but there's enough randomness and non-obvious substitutions to make it pretty safe - according to my1login, it would take 2 hundred trillion years to crack it, which is well into the Universe's degenerate era. I doubt if even Nelson Mandela will be around by then.

gareth170 · 6 Sep 2013 at 12:17

CaptainCrash said:
My LastPass master password is 26 characters.

It's not completely random, but there's enough randomness and non-obvious substitutions to make it pretty safe - according to my1login, it would take 2 hundred trillion years to crack it, which is well into the Universe's degenerate era. I doubt if even Nelson Mandela will be around by then.

tbh I wouldn't of put your real password on that site to check.

Raumarik · 6 Sep 2013 at 13:15

gareth170 said:
tbh I wouldn't of put your real password on that site to check.

Shh I'm getting lots of good stuff via there..

CaptainCrash · 6 Sep 2013 at 13:26

Halfmad said:
Shh I'm getting lots of good stuff via there..

Dammit, I've just had a debit on my Visa account for "Teenage Russian Midget **** Gobblers." Was that you? :mad:

Macro · 6 Sep 2013 at 16:28

Has anyone imported a Keepass d/b into Lastpass? I'm giving LP a try after using Keepass for years and a bunch of my logins in the database don't have a URL associated. With KP I would just cut and paste but obviously with LP it has the advantage of auto recognising the site based on the URL.

There seems no easy way to update my existing entries in LP. I go to a site, login, LP asks if I want to save the details and at that point I really want to "save to existing entry" to update the URL. Instead I have to save to create a new entry, edit it to copy the url and paste into the old/pre existing entry and then delete the new one.

Not the end of the world but I can't help but feel I'm missing a more obvious way to update an entry.

Any ideas?

KIA · 6 Sep 2013 at 18:01

gareth170 said:
i could put the database on my 4TB NAS that way it'll be accessible to my devices but not to the internet. is that better idea.

i got to about 107 bits

Sounds good. Don't forget to create a backup of the database on a regular basis, just in case.

gareth170 · 7 Sep 2013 at 10:39

KIA said:
Sounds good. Don't forget to create a backup of the database on a regular basis, just in case.

well my NAS automaticly makes a second copy of everything.

is it more secure if i use the hidden option and/or put the database in a rar file which has a large file in it that way "if" anyone trys to get it from my pc they would have to download a big file (upload from my pc) and i would easyly know by if the speed drops

KIA · 7 Sep 2013 at 13:24

Sounds like a lot of hassle to me. The attacker could extract the archive to get the database.