In comp.misc, The Real Bev <bashley101@gmail.com> wrote:
> So your passwords work even if keepass is inexplicably down and you
> don't know what they are? Is there any way to find out what they are?
> I assume you're using a password-generator that gives appropriate
> combinations of unintelligible characters...

Keepass is a standalone tool with a standalone database.

You don't need to be online to use it, so the site can go down.

It's open source with clients for various OSes & devices, so the site
can go down and you stand a chance of getting your passwords out on a
new phone or computer.

> What I'm really asking: Can you access legible passwords (that you
> can feed into your broker/bank/whatever by hand) if keepass ceases to
> exist?

Yes, if you have the database file and the master password for it.

https://en.wikipedia.org/wiki/KeePass
KeePass Password Safe is a free and open-source password manager
primarily for Windows. It officially supports macOS and Linux
operating systems through the use of Mono. Additionally, there are
several unofficial ports for Windows Phone, Android, iOS, and
BlackBerry devices. KeePass stores usernames, passwords, and other
fields, including free-form notes and file attachments, in an
encrypted file. This file can be protected by any combination of a
master password, a key file, and the current Windows account
details. By default, the KeePass database is stored on a local file
system (as opposed to cloud storage).

It's not a great tool from a usability point of view, in my biased
opinion, but it works and is safe from subscription lock-in.

Elijah
------
has seen it used at a couple of jobs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The Real Bev wrote:
> On 02/08/2022 04:18 AM, Dan Purgert wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> The Real Bev wrote:
>>> Not to mention the danger of hackage of the password-storage website.
>>
>> Where on earth have you gotten this idea of a "password storage website"
>> from? KeePass is an application running locally on your PC, no network
>> communication required.
>
> Just from what I've read here. I'm not interested in any password that
> I can't read and reproduce by copy/pasting, so I haven't done any
> research at all.

Okay, then it's a bit of miscommunication somewhere.

KeePass (and its variants) is a stand-alone piece of software, that is
not reliant on any "web service" to keep running. Worst case, the
database will get corrupted (but that's what backups are for, incl. the
regular - albeit infrequent - plaintext export).

> Just for curious -- why do you bother with pgp for public comments like
> this?

Long time ago it made sense (proof it was me and all). Nowadays it's
more just because.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3asj+xn6fYUcweBnbWVw5UznKGAFAmIEYKIACgkQbWVw5Uzn
KGDr5BAAoFYpAyQOpHt5grrkurUHGCBWBUsgX5AiG0/xu4TzlKMhDeThJU+22gst
d+X2+sPb/UP7v5H0hSUzhQ3dQGTxcpKFOmYSQNT8rXaMj1i1ucy2+iAoNdpL7PXV
uwvDW8b8LN1GcfYFirUoqYX6ggC3iMFyXuzGRLQ4Eju4R6rwIDgYD/PxaZSZqwqo
8I3UuncH+2qpr2McFdRykgMJjnGcNqZo/p0Kbx25QW0G8ihwkVESlsu2Dmv6buil
3SgFPtX92Y5klLweLSbU4CmbN/KtQyBF4fXV56LVX4Xdfd+j9zXmy8LkPw17d+2w
2NKcEIN/Jc8gcicm1zKtKoDXG4KRLhwXNdrnWyv+b7mxEw0dZzeQJMbyRdpNPgia
dxYPeeMNnmfKSp9E6e61sYB3Z6P5hX+5kwB7CZxiIBFzSUnsE1WPmMwj9v+MbNm3
YRIMftsElqrv19DQHdBQJYLrIJqsO2RYWdAo99OATFTXzGkYsSWxoVGTsZqWVG0f
o+32EJkmVIHEMhNBh7LlqobnpWP0e9kHVu94e2vh+PO8nvIsERwjK0aDVqLnyERQ
e4UkzuR7i4LRVgVkPwray8dppRSmWk+6wKJ6S/nEKijUi/HqHYCQajsj+4iHej22
ApRJATtAEsVWxqdxuTEtzQXIFbliUPlk3ZoCn64wx/LAYJoThNM=
=WRmM
-----END PGP SIGNATURE-----

--
|_|O|_| Github: https://github.com/dpurgert
|_|_|O| PGP: DDAB 23FB 19FA 7D85 1CC1 E067 6D65 70E5 4CE7 2860
|O|O|O|

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The Real Bev wrote:
> On 02/09/2022 11:29 AM, Dan Purgert wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> scott@alfter.diespammersdie.us wrote:
>>> The Real Bev <bashley101@gmail.com> wrote:
>>>> Not so with a password storage site, which might simply cease to exist.
>>>
>>> That's not an issue with KeePass. You store your password file wherever you
>>> want: cloud storage (aka "someone else's computer"), your own server, a USB
>>> flash stick, whatever. I keep mine on the Nextcloud server in my living
>>> room next to the TV, accessed remotely by WebDAV.
>>
>> Same, auto-sync is so nice :)
>>
>> Although, for the longest time I just had the one copy rsync'd to a
>> backup machine.
>
> I have long been distrustful of 'syncing' machines because I have yet to
> see an actual definition: (1) Do you copy the contents of machineA to
> machineB, deleting the previous contents of machineB? (2) Vice versa?
> (3) Do you copy the contents of A to B, leaving the files of B that had
> no counterpat on A alone? (4) Do you copy the contents of each machine
> to the other, ending up with both machines containing all the contents
> of both of the original machines? I can't believe that, but how else do
> you 'sync' the unique contents of B to A and vice versa? Do they all
> have to use the exact same operating system?

(1) Depends.
1.1 Rsync - at least for my use - is one-way from a given machine to
a backup server in most cases (I mean I do have to restore every
now and again). PC is "master" in that regard, and overwrites
"server".
1.2 Nextcloud is more of a "network share" -- all machines always have
the same data (well, less any sync delays; although I believe that
opening a file checks if the file's changed on the server first).
1.3 I also use git for programming projects; and that enforces
"central server is master", requiring some manual intervention
if someone else made changes that I don't have.

(2) I think I answered this above. Lemme know if you want more
clarification.

(3) Depends
3.1 For rsync'd things, I don't do 'deletes' on sync if something's
on "backup server" and no longer on "pc" (laptop, whatever)
3.2 & 3.3 For nextcloud or git stuff, the server usually keeps some
"reversion" history that I can undo an oops with; but otherwise,
deleting from one deletes from everything.

(4) Not entirely.
4.1 Rsync stuff only represents a given machine's $HOME directory
(plus maybe /etc or some /usr/local/bin scripts I wrote myself),
less "Nextcloud" data. I suppose this would be what you consider
the "on machine A, but not on B" stuff.
4.2 All machines that utilize Nextcloud have the same data as what's
tossed into the shared directory (i.e. $HOME/Nextcloud/). The
Nextcloud sync client is cross platform - running on Win / Linux
/ android / Mac / iOS.
4.3 Only those projects that are on multiple systems get "sync'd", and
"syncs" are manual. Git, like Nextcloud, is cross-platform,
although I don't use it on Windows.

> What if you 'sync' five machines? Which one, if any, takes precedence?

The central server that's hosting Nextcloud (or git). After that, all
the client machines are "equals". Syncs happen pretty frequently across
most everything, except the android phone (but that's because I opted to
have that only sync hourly).

Rsync backups, each individual PC is the "master", and the backup server
just takes whatever "new" data the machine(s) send to it.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3asj+xn6fYUcweBnbWVw5UznKGAFAmIEaE8ACgkQbWVw5Uzn
KGDaig/8D1jd0ghRGtkSdmuF0bVskhr8FzZMjlGA2nb+ESBDnRXE41f8kCep5mmQ
lMA1gI/fZQMk3TFkgGBWM1HNm6+Ytdi+RUDL005BPHDIcmFVyn2guxvkqZ0kmZl1
9TPM0A1SwxFA/kZoAXhCQBbyKA6oxj2NN/j5rcmmMlSM5nscH1zMxlmpKvGFsIdZ
RXZpsr4fcKnlVLjn5ucw7yPDyx4eQgqi2voeOQhwQsRDjxtho1I45RvGHxNTZs0d
+R4g/0ra0rFj23wmmIvN8pdwfwnWse95cPwU4+MH08bzS/tDWSVWSf9HqcAvdcx1
w28pUufWvGFpHsPZqouoJVG2YK7w6xJK0wLjnXt4SmWRYxLHqPUC9OP/XFUfwfvA
w3fMKxAu5kkt619Huz3PMU6i0RY4YfVqBBFCQcl0VhVMeFlZ7ijbFdnvx5a0ZobU
x8AZqNuPsWzRZ0bMmwiTtJeU4X5vNw8ID9K1+hHw8UNywIGRQHswJtKlpPXYZ2Bt
spTXX6aRhS9GtH+RNE9jUpHmriLNrCBiHZ3XL1e/XtdgOWHw40zYOh1vtKx8eUcc
2VsS4Yj0N2kDqFPRADZPqH4YtelTibCdhHmp9DBTNp+vuG6nz0CHpSU8h7CyxYn/
b3EtulrsVCgOxlTrBPNR257jsutzIqgfAEHcjpIMixJ9OzqmS74=
=WWIF
-----END PGP SIGNATURE-----

--
|_|O|_| Github: https://github.com/dpurgert
|_|_|O| PGP: DDAB 23FB 19FA 7D85 1CC1 E067 6D65 70E5 4CE7 2860
|O|O|O|

The Real Bev <bashley101@gmail.com> wrote:
> So your passwords work even if keepass is inexplicably down and you
> don't know what they are? Is there any way to find out what they are?
> I assume you're using a password-generator that gives appropriate
> combinations of unintelligible characters...
>
> What I'm really asking: Can you access legible passwords (that you can
> feed into your broker/bank/whatever by hand) if keepass ceases to exist?

KeePass is a program, not a website. As long as you have a copy of it and
something that will run it, you can use it to access your passwords. It
stores your password file wherever *you* want to store it, and it has a
plugin system to extend its capabilities. (I use plugins for browser
integration and to have it store TOTP 2FA credentials for sites that use
them...it's easier to look up that six-digit code in there than to fire up
the phone and look it up on that.)

As long as you have a source tarball or binary (whether for KeePass or one
of the many other programs that understand its data format), you'll have
access to your passwords.

--
_/_
/ v \ Scott Alfter (remove the obvious to send mail)
(IIGS( https://alfter.us/ Top-posting!
\_^_/ >What's the most annoying thing on Usenet?

On 02/09/2022 05:19 PM, Dan Purgert wrote:

> Rsync backups, each individual PC is the "master", and the backup server
> just takes whatever "new" data the machine(s) send to it.

Thanks. I have one linux, one windows and a couple of androids. The
only common software is Firefox, and I really only use that on the linux
machine. The winmachine is only used for tax software and I don't like
firefox on Android because it takes longer to start than whatever the
native app is.

I think making multiple linux backups, copying the resulting tax files
to pdfs (and the actual .tax [or whatever] files) to the linux machine
and letting the Pixel autobackup to wherever it autobacksup to is
sufficient.

I'm annoyed that SOME android apps won't save the password -- like I
give a shit about even HAVING one, much less having to remember the damn
thing. The only one I deliberately tell not to remember is the one for
my bank, and I only have that on the phone so I can deposit the odd
check I receive without having to walk to the bank itself.

--
Cheers, Bev
Why is it so hot and what am I doing in this handbasket?

On 2022-02-05, meff <email@example.com> wrote:
> On 2022-02-05, Scientific ⚧ <science@danwin1210.de> wrote:
>> A PGP-signed message, nice. Do you think that there should be a
>> newsgroup reader for Android?
>
> An Android newsreader would be fantastic IMO.

There are newsreaders for Android. I use HotDogEd. Use "nntp" as your
search term in the play store, they are plenty to choose from.

On 2022-06-02, Vlad Markov <vlad@happy.dwarf7.net> wrote:
> There are newsreaders for Android. I use HotDogEd. Use "nntp" as your
> search term in the play store, they are plenty to choose from.

Huh I think I was looking around in F-Droid and never bothered looking
in the Play Store. My mistake, there are a couple apps here I'd like
to try out. Is "HotDogEd NNTP Provider" the one you use?

On 2022-06-07, meff <email@example.com> wrote:
> On 2022-06-02, Vlad Markov <vlad@happy.dwarf7.net> wrote:
>> There are newsreaders for Android. I use HotDogEd. Use "nntp" as your
>> search term in the play store, they are plenty to choose from.
>
> Huh I think I was looking around in F-Droid and never bothered looking
> in the Play Store. My mistake, there are a couple apps here I'd like
> to try out. Is "HotDogEd NNTP Provider" the one you use?

Yes, that is the one I use. For some reason I ended up installing 2
apps to get it going. I do not like that it "catches up" on the server
vice the group.