I use keepass with  Key and Master password combination. I store the 
password database on the dropbox/SFTP  and carry my key with myself on 
my cell phone, laptop etc. and then the master password is in my mind :) 
. So with this , even if my password database gets compromised or 
dropbox gets hacked, My password database is still encrypted and the 
keys/password is not with the password database file.

Amit K Nepal
(CISSP, RHCE, CCENT, C|EH, C|HFI, GIAC ISO 27000 Specialist)

On 7/28/2016 1:25 AM, Joseph Sinclair wrote:
> I do use Lastpass, fortunately I do not use the Firefox client affected by the latest issue, which has already been patched (One thing Lastpass has done well is security response and patching).
> I don't store everything there, but I do store some things there for various reasons (mostly needing to use them on idiotic sites that actively block copy/paste).
>
> I store absolutely everything in encrypted databases (multiple small files for performance and separation) (not keepass, mono is too much of a pig to run on my desktops).
> The encrypted files (never decrypted to anything but RAM, and that's overwritten with 0's in the program as quickly as possible) are stored in a DVCS (e.g. git, mercurial, DARCS, Bazaar, etc...) that I sync via it's normal repo synchronization.  I gain the advantage of "oops" recovery as well with the version history.
> The repo is NEVER online, however, just filesystem-to-filesystem "remote" sync.
>
> Nothing's perfect, but the amount of work needed to get past the encryption should vastly exceed the rather low value of what's stored there (in my case).
>
>
> On 07/27/2016 03:34 PM, Stephen Partington wrote:
>> I know several of you here are using keepass. of those users who is working
>> with the various browser integrations and the various android apps. and the
>> usual or unusual means of keeping the db across multiple locations.
>>
>> I have been wondering about keepass and its use for some time, but now with
>> the recent security hold found in Lastpass i am taking a second look at it.
>>
>> https://nakedsecurity.sophos.com/2016/07/27/lastpass-password-manager-zero-day-bug-hits-the-news/
>>
>> ​PS i know this is not a real 0 day bug, so does the author. not sure why
>> he decided to do that sort of weird headline.​
>>
>>
>>
>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>
>
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.phxlinux.org/mailman/listinfo/plug-discuss