Managing secrets - passwords, keys, and seeds

Overview: This guide suggests a 'solution' for managing secret data that is potentially compatible with most threat models.

Motivation

Passwords, PGP keys, SSH keys, onion service private keys, XMR wallet seeds, addresses, contacts and encrypted messages - it can be a daunting task to securely create, store, and maintain all of that private data.

Assumptions

• you're on a GNU/Linux machine (Debian/-based)
• basic terminal knowledge
• a five dice set
• ~15 mins free time

1. Install KeepassXC

Let's first install the KeepassXC¹ open-source password manager:

sudo apt install keepassxc

2. Create database

Open up KeepassXC and hit CTRL+SHIFT+N to create a new database. The default Decryption Time, Database format and Encryption settings should be fine.

A dice-generated passphrase should be perfect for the master password.

Download any good word list file²'³'⁴'⁵. We will use EFF's new large word list file efflargewordlist.txt (5 dice, 7,776 words):

curl -O https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

Roll a set of five dice all at once and write the numbers down.

Example roll:
1, 1, 6, 5, 3

Find the corresponding word for the roll with:

grep "11653" eff_large_wordlist.txt

This should output:

11653 animation

We now have the first word of our master password: animation.

Keep rolling until you generate at least 6 words (77 bits of entropy).

Example six-word passphrase:
animation approach corral stoneware blinked hardcore

Use this as your KeepassXC master password and save the encrypted database file (ie. Passwords.kdbx).

Note: you could optionally disguise the file by saving it with a random name and a more common extension (ie. styles.css).

Memorize the passphrase.

Note: if you don't have a dice set, you can generate random passwords and passphrases in KeepassXC by clicking on the 'dice' icon.

3. Workflow

KeepassXC is very easy to use.

Create entries with CTRL+N or use the + icon, generate new passwords with the dice icon, copy and paste passwords from KeepassXC to websites and applications, edit entries with CTRL+E, lock the database with CTRL+L or by pressing the lock icon.

Remember to backup your database files regularly by using the Save Database Backup.. option under the Database menu.

Observations

• review your threat model⁶ when deciding if and how to best use the tools described in this guide
• store database backups on separate machines/devices
• whenever possible, opt for more entropy; go for 8+ word count for passphrases and 20+ characters for passwords (100+ bits of entropy)
• do not reuse passwords
• also saving passwords down on paper/metal might not fit your threat model
• consider additional security risks before using any online password managers
• it is recommended to build KeepassXC from source⁷
• KeepassXC can generate 2FA codes
• avoid using KeepassXC browser extensions; copy/paste instead
• a viable alternative to KeepassXC might be pass⁸, the Unix command-line password manager
• dig deeper: EFF⁹, Kicksecure/Whonix¹⁰'¹¹

That's it. Now you can securely create, store and maintain your private data.

• 1: https://keepassxc.org/↩︎
• 2: https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt↩︎
• 3: https://www.eff.org/files/2016/09/08/eff_short_wordlist_1.txt↩︎
• 4: https://www.eff.org/files/2016/09/08/eff_short_wordlist_2_0.txt↩︎
• 5: https://world.std.com/~reinhold/diceware.html↩︎
• 6: /threat-modeling-demystified/↩︎
• 7: https://github.com/keepassxreboot/keepassxc/blob/develop/INSTALL.md↩︎
• 8: https://www.passwordstore.org/↩︎
• 9: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases↩︎
• 10: https://www.kicksecure.com/wiki/Passwords/↩︎
• 11: https://www.kicksecure.com/wiki/Keepassxc/↩︎