add-url-to-window-title VS PassGen

ive mainly been using keepassxc for a few years which is not too ugly i don't think, but have been trying out keeweb recently which is a lot more minimal.

a neat feature with keepass is autotype. i have mine set to alt+x so its easy to activate and using the "add url to window title" extension means there's no connection between your vault and the browser.

https://github.com/erichgoldman/add-url-to-window-title

another idea i had recently was to create a second vault for passwords that aren't that important. so now they majority of my passwords are in that and the vault master password is shorter so its quicker to type, while anything important goes in my main vault which has a stronger password. its great not having to type a really long password just to unlock my vault so i can log into some random forum! and it also means im less paranoid about leaving the vault unlocked.

> another downside with auto-type is that not all websites put their full names in the browser title bar so auto-type won't show you your related passwords in some cases. to fix that you can install a browser extension that puts the full web url in titlebar https://github.com/erichgoldman/add-url-to-window-title

Instead of modifying the browser title, I use AutoTypeSearch plugin for Keepass, that opens a dialog allowing me to suggest entries in case of no matches.

There is also another plugin that allows search using both URL and title -- "WebAutoType".

These two plugins together make the Keepass experience almost seamless.

Don’t use the same password on multiple sites. I have my own password generating shell script which uses strong cryptography which takes a secret and a site name, and generates a strong password (secret is protected with key stretching). Other similar solutions exist (LastPass, etc.)

I do not use a browser-based password generator, because of the Javascript insecurity issues. I use a shell script, with a small C program to handle the core cryptography, to generate secure passwords.

I run the password generator in a terminal window, then copy and paste the password in to the site I am trying to log in to.

It’s a fairly complicated shell script, since it also has to deal with nonsense like stupid arbitrary password rules (e.g. Southwest considers an underscore to be a letter, and insists at least one non-letter non-number punctuation is in a password; some places require a password to be 8 characters or shorter; etc.) and also provides login information so I can also remember my username.

As recently as 5 or 6 years ago, there were issues with websites which wouldn’t let you copy and paste a password in to their password field; Firefox has always had a “ignore any Javascript which stops pasting” special rule in about:config I had to use. I haven’t seen one of those in a while; developers finally got a clue and realized that password managers exist.

One weakness this setup has is that anyone with the “master key” can get all of the password generated by the password generator. My workaround is to use a separate master key in a virtual machine for critical passwords, such as online banking ones.

Shameless plug time:

https://github.com/samboy/PassGen/