Any explanation of Why to not store passwords in plaintext and encrypt folder in zip archive (I guess U cant break pass?) Pls don’t be agressive!!

  • beta_tester@lemmy.ml
    link
    fedilink
    arrow-up
    69
    ·
    10 months ago

    You can develop apps in a text editor. We don’t do it because we’ve got better tools. Text editor work but developer focused IDE’s work much better and are very convenient.

    it may encrypt your password but using kdbx files are much more convenient, efficient, etc.

  • tatterdemalion@programming.dev
    link
    fedilink
    arrow-up
    47
    arrow-down
    1
    ·
    edit-2
    10 months ago

    If your goal is to “self-host” a password manager, you might as well use Keepass + SyncThing.

    • free software
    • master password protected
    • has organization and auto-fill features
    • can sync across multiple devices

    Usually the downfall of rolling your own password manager is it’s easier to make mistakes and accidentally lock yourself out. Or if you don’t keep backups/replicas then you could easily lose your passwords.

    • gray@pawb.social
      link
      fedilink
      arrow-up
      8
      ·
      10 months ago

      Or self host Bitwarden and you don’t have to bother with syncing the file around.

      • wreckedcarzz@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        10 months ago

        Vaultwarden (server) + bitwarden (application, extensions), and save money while getting most enterprise features.

  • algernon@lemmy.ml
    link
    fedilink
    arrow-up
    43
    arrow-down
    2
    ·
    10 months ago

    Very bad, because the usability of such a scheme would be a nightmare. If you have to unzip the files every time you need a password, that’d be a huge burden. Not to mention that unzipping it all would leave the files there, unprotected, until you delete them again (if you remember deleting them in the first place). If you do leave the plaintext files around, and only encrypt & zip for backing up, that’s worse than just using the plaintext files in the backup too, because it gives you a false sense of security. You want to minimize the amount of time passwords are in the clear.

    Just use a password manager like Bitwarden. Simpler, more practical, more secure.

  • ArbiterXero@lemmy.world
    link
    fedilink
    arrow-up
    41
    ·
    10 months ago

    In many unzip utilities, they use temp files that you wouldn’t be paying attention to. These temp files will contain your credentials and you won’t know where they are or if they got deleted.

    • m-p{3}@lemmy.ca
      link
      fedilink
      arrow-up
      21
      ·
      edit-2
      10 months ago

      And even if they’re deleted by the archive program, it’s likely a normal deletion, and not a secure delete where the original data is overwritten with random data before deleting the entry in the file system, which could be potentially recovered.

    • nicetriangle@kbin.social
      link
      fedilink
      arrow-up
      4
      arrow-down
      1
      ·
      10 months ago

      Yeah zips have no mechanism to prevent brute forcing as far as I’m aware. You can attempt as many passwords as you want as frequently as you want without any sort of rate limit.

      • Danny M@lemmy.escapebigtech.info
        link
        fedilink
        arrow-up
        28
        ·
        10 months ago

        That’s not the issue. You can attempt as many passwords as you want in actually secure password managers as well. KeepassXC for instance IS secure, you can still brute force the password, but because of the hashing algorithm they use it’s extremely hard. With PKZIP if you know some of the words in the file, you can easily guess the password in just a few hours because the encryption algorithm it uses isn’t secure

        • Supermariofan67@programming.dev
          link
          fedilink
          arrow-up
          5
          ·
          10 months ago

          Both are true. Brute forcing zips is also faster than brute forcing almost anything else. Other formats use key derivation functions like PBKDF2-SHA1 (hundreds of thousands of iterations of sha1) to slow down the calculation of the key from the password, but PKZIP does not do this. Brute forcing zips can be done at 10 billion passwords per second on a typical GPU, whereas rar/7z/keepass are only a few thousand per second.

          Here’s an interesting research paper describing both the known plaintext attack and the standard brute force attack https://www.scitepress.org/Papers/2019/73605/73605.pdf

        • Ignotum@lemmy.world
          link
          fedilink
          arrow-up
          3
          ·
          10 months ago

          I used to get some documents sent in a password encrypted zip file, they regularly messed up the password, so i ended up just brute forcing them when i received them since it was easier and faster (usually like 15 seconds)

          Not very relevant here since i knew roughly the length of the password and it was quite short, but i thought it was pretty funny

  • kureta@lemmy.ml
    link
    fedilink
    arrow-up
    28
    ·
    10 months ago

    If you do this, you’ll start writing small scripts to help you with repeating tasks, to simplify somethings, then you’ll start looking for help trying to improve those scripts, then you’ll find better written and tested ones and start replacing yours with those, one by one. Then you’ll probably find pass or other terminal password manager. It can be a fun learning experience but sooner or later you’ll end up using a password manager.

    • Tangent5280@lemmy.world
      link
      fedilink
      arrow-up
      3
      ·
      10 months ago

      Ah, the programmers pilgrimage. The first hill that they must climb is the one where they spend 12 days automating something that would have taken 10 seconds every time + half hour setup time.

  • zeluko@kbin.social
    link
    fedilink
    arrow-up
    28
    ·
    10 months ago

    I dont see the “manager” part in your zip archive…
    More like a bunch of text files… and you are doing the job of the manager

    • pafu@feddit.de
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      10 months ago

      pass has a similar spirit, where passwords are just GPG encrypted files with some CLI glue on top.

      You could achieve the same with an encrypted .zip file and a bit of bash, even if it would probably be less ergonomic.

  • cooopsspace
    link
    fedilink
    English
    arrow-up
    21
    arrow-down
    1
    ·
    10 months ago

    Because it’s bad, prone to errors, user interface is poor and relies on you following your process perfectly every time.

    Bitwarden.

    Or KeePass.

  • utopiah@lemmy.ml
    link
    fedilink
    arrow-up
    17
    arrow-down
    1
    ·
    10 months ago

    Depends against whom you are protecting yourself. If it’s against

    • your younger sibling then it’s probably sufficient
    • some script kiddie or scammer running scripts against the most typical setups, might be just obscure enough
    • a proper targeted attack, then it will depend on which zip software you are using. Most likely the stock one that might (I didn’t bother checking) relying on something that is far from the state of the art in terms of encryption. In that case it will most likely not be secure.
    • a proper attack but you use something like 7z with encryption that is relatively resilient, then most like if you are not facing state actors with huge amount of resources to try to crack it, most likely secure

    Note I’m NOT a security expert so… don’t believe me.

    • Billegh@lemmy.world
      link
      fedilink
      arrow-up
      4
      ·
      edit-2
      10 months ago

      I don’t know that I’d really add more. It all depends on who and what you’re protecting against. The only thing that’s secure is something that doesn’t exist.

      National level hackers have access to resources you might not be able to think of. And if they really want in, rubber hose cryptography is super effective. But most “hackers” on the Internet? And encrypted zip is often enough to deter them. Not impossible, but you might not be worth the time and effort.

      In summary, there is better. Much better than an encrypted zip file. But only you can judge if you’re a juicy enough target to pursue more esoteric protection.

  • Imprint9816@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    14
    arrow-down
    1
    ·
    10 months ago

    You can. You can also light your house with just candles. Its just not a very efficient or effective way of doing it and you lose out on modern features.

  • Elise@beehaw.org
    link
    fedilink
    arrow-up
    13
    ·
    10 months ago

    To add to the rest: A manager also stores the history. And it has a pass generator. And lots of quality of life things.

  • Monkey With A Shell@lemmy.socdojo.com
    link
    fedilink
    arrow-up
    7
    ·
    edit-2
    10 months ago

    There’s two avenues for opening an encrypted file, attacking the password/access method or attacking the encryption itself.

    Generally using a basic zip-lock is not going to have a second factor, a rate limiting mechanism, anything really other than the password to stop a random brute force effort if they got a hold of the file for local processing.

    Using something with some front end protection like bit warden with 2FA or keepass with the key file option added in makes it more a task of going after the crypto itself which is a much much harder approach.

  • topperharlie@lemmy.world
    link
    fedilink
    arrow-up
    6
    ·
    10 months ago

    One thing to think about is the encryption quality of a zip file, which I ignore.

    One danger that I see is that you have the risk of having the passwords on the clear all over the place many times. Not an expert so don’t quote me on this, but password managers are careful avoiding passwords on the clear as much as possible.

    I don’t trust any online service for that, I am using keepass/syncthing for myself, with android as the only client decrypting (as I always have my phone with me). one example of advanced security measures is that while using the app I can’t take screenshots, and I hope/expect that it uses images backed by secure memory to show them to me and is careful with things like RAM and temporary files (didn’t check personally though, although being open source I could)

    Having to be sure that your zip app handles that seems like a hustle honestly. On top of having random passwords without the biases I would add for each separate site.