26 Dec 2022 [CT] [guides]

CT-010: Managing passwords, keys, and seeds

This is the 10th report in the Cypherpunk Transmission series.

Motivation

Passwords, PGP keys, SSH keys, onion service private keys, XMR wallet seeds, addresses, contacts and encrypted messages - it can be a daunting task to securely create, store, and maintain all of that private data.

This guide suggests a solution that is potentially compatible with most threat models.

Assumptions

you’re on a GNU/Linux machine (Debian/-based)
basic terminal knowledge
a five dice set
~15 mins free time

1. Install KeepassXC

Let’s first install the KeepassXC¹ open-source password manager:

sudo apt install keepassxc

2. Create database

Open up KeepassXC and hit CTRL+SHIFT+N to create a new database. The default Decryption Time, Database format and Encryption settings should be fine.

A dice-generated passphrase should be perfect for the master password.

Download any good word list file²’³’⁴’⁵. We will use EFF’s new large word list file eff_large_wordlist.txt (5 dice, 7,776 words):

curl -O https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

Roll a set of five dice all at once and write the numbers down.

Example roll:
1, 1, 6, 5, 3

Find the corresponding word for the roll with:

grep "11653" eff_large_wordlist.txt

This should output:

11653	animation

We now have the first word of our master password: animation.

Keep rolling until you generate at least 6 words (77 bits of entropy).

Example six-word passphrase:
animation approach corral stoneware blinked hardcore

Use this as your KeepassXC master password and save the encrypted database file (ie. Passwords.kdbx).

Note: you could optionally disguise the file by saving it with a random name and a more common extension (ie. styles.css).

Memorize the passphrase.

Note: if you don’t have a dice set, you can generate random passwords and passphrases in KeepassXC by clicking on the ‘dice’ icon.

3. Workflow

KeepassXC is very easy to use.

Create entries with CTRL+N or use the + icon, generate new passwords with the dice icon, copy and paste passwords from KeepassXC to websites and applications, edit entries with CTRL+E, lock the database with CTRL+L or by pressing the lock icon.

Remember to backup your database files regularly by using the Save Database Backup.. option under the Database menu.

Observations

review your threat model⁶ when deciding if and how to best use the tools described in this guide
store database backups on separate machines/devices
whenever possible, opt for more entropy; go for 8+ word count for passphrases and 20+ characters for passwords (100+ bits of entropy)
do not reuse passwords
also saving passwords down on paper/metal might not fit your threat model
consider additional security risks before using any online password managers
it is recommended to build KeepassXC from source⁷
KeepassXC can generate 2FA codes
avoid using KeepassXC browser extensions; copy/paste instead
a viable alternative to KeepassXC might be pass⁸, the Unix command-line password manager
dig deeper: EFF⁹, Kicksecure/Whonix¹⁰’¹¹

That’s it. Now you can securely create, store and maintain your private data.

Feedback

Let me know if you find this helpful and, depending on interest, I will do my best to post a new Cypherpunk Transmission report every (other?) Monday.

Questions, edits and suggestions are always appreciated @ /about/.

-3RA

Credit goes to gnuteardrops from monero.graphics for the amazing xkcd graphic. Work and xkcd Script font licensed under CC BY-NC 3.0.