Once a friend of mine complained on Twitter that the site he was interested in had an inconvenient set of supported characters (some of the special characters familiar to him were missing). After that, we started about the following dialogue:
– So, after all, there are no special difficulties with this, business, then – click a couple of checkmarks in the password generator and you're done.
“I don’t use a password generator.”
– But why?
– Because you have to log into different sites from different devices: a smartphone on Android, a work PC on Windows and a home PC on Ubuntu.
– But there are synchronization means …
Why a password manager
There are many articles about password security, and nearly all of them agree on the following:
- passwords should be as complex as possible (about 20 characters, including letters, numbers and special characters – this is not overkill, but the norm);
- passwords must be unique (if the password database of some service suddenly 'leaks', then you can be sure that you will not be able to access other services with a compromised password).
Obviously, it is quite difficult to ensure security by inventing passwords and memorizing them in your head (you can still think of it, but keeping several dozen rather complex passwords in your head is an extremely non-trivial task).
Objectives
Some time ago I was solving just such a problem: choose a password manager available on several desktop OS (Windows, Mac, Ubuntu), as well as on Android. There were no support tasks iOS at that moment, but providing this would be a nice bonus.
A separate goal was to ensure synchronization of the password database. Passwords can be generated as well as used on different platforms. Moreover, ideally, the synchronization tool should not use any intermediate servers (so that there is not even a theoretical problem of leaking the password database due to the fault of the service).
And ideally, I would like the set of all tools to be free. As a last resort – with a one-time purchase. But no monthly fees.
Solution – password manager
Free password manager with implementations for all target platforms: KeePass:
- Windows – the original version works;
- Ubuntu – KeePass 2 is cross-platform (via mono), KeePass X is also available. Both applications are installed via the standard application center;
- Mac – MacPass works (despite the status of the alpha version for two years of use, I did not have a single problem);
- Android – KeePassDroid is running;
- iOS – MiniKeePass is working;
The technology for using KeePass is as follows:
- at startup, specify a file with passwords and a password to open this file;
- open an existing group or add a new one;
- generate passwords;
- copy names and passwords in order to paste them into a browser or other application.
Solution – Synchronization Tool
BitTorrent Sync (now Resilio Sync ) was chosen as the synchronization tool. Unlike Dropbox, Google Drive and other similar services, Resilio Sync does not use a server to store synchronized data: it is sent only between end devices.
Resilio Sync under Windows and Linux works as a local service with browser access. A separate application is launched on the Mac.
The BitTorrent / Resilio Sync technology is as follows:
- create a folder on one device (the mobile application offers to immediately create a backup – a folder that will be read-only on other devices);
- send a link to another device;
- add a link on another device;
- on the first device, approve the connection of the second device.
Total
The combination of KeePass and Resilio Sync allowed us to solve all the initially set goals. Password sync works great on all required platforms.
Are there any alternatives? Of course. You can see, for example, LastPass. If you don’t mind paying for such a service and you don’t need it Linux, then there is an option with 1Password.
Is there a different way to synchronize the password database if a password manager is already selected? Yes, there are options with classic storage that supports syncing (Google Drive, Dropbox, OneDrive), of course, if you are comfortable with that level of security. Also, if you have a NAS, take a look at its proprietary utilities. Perhaps there is also a tool for synchronizing data.
Links for Android
- KeePassDroid
- Resilio Sync