Mac for Hackers: How to Manage Your Passwords with KeePassX « Null Byte :: WonderHowTo

Now that we've learned aboutkeeping all our data safe with encryption, it's time to continue progressing throughgetting your Mac set up for hacking.Just like most other people, we hackers have a lot of credentials to manage. We're also human, so we have a hard time creating random difficult-to-brute-force passwords. So instead of rolling upallof our passwordswith Diceware, we'll let our machine do the work for us—both in guarding the passwords and generating them. For this, we'll use a password manager.There are many password managers on the market, and some of the heavy hitters for macOS areLastPass,1Password, andKeePassX. I prefer KeePassX because it's open source, very secure, works on almost everything, and allows me control over my key database and key file. KeePassX uses either 256-bit AES or Twofish to encrypt the password vault, and has had only a couple of CVEs (Common Vulnerabilities and Exposures) in its lifetime.Previously:How to Create an Encrypted Disk ImageStep 1: Get KeePassXOur first step is todownload KeePassX from their website. Once we have the disk image, we will mount it and drag KeePassX into our Applications folder.On most macOS systems, we will not be able to run this app right out of the box due to the app being from an unidentified developer. Since KeePassX is unsigned, we will need toenable a security exception. If you are not comfortable with this, you may want to consider a different password manager.Don't Miss:How to Open Third-Party Apps from Unidentified Developers in macOSNavigate to KeePassX in your Applications folder, then control-click (or right-click) on the KeePassX icon and select "Open" on the prompt. You will then be greeted with this screen:Not much going on here, but that will change.If you already have a KeePass database, you can open it now by selecting "Database" in the menu bar and clicking on "Open database." If you don't already have a database, that's okay—just keep on reading.Step 2: Create a New Key DatabaseWith the KeePassX window selected, go to "Database" in the menu bar and select "New database." For this tutorial, I will be using a key file along with a password. Without the key file, the database is useless.If you lose the key file, you will lose all of your passwords. I keep a backup of my key file somewhere safe, and a copy of it on a USB key. If I stored the key file with the key database and an attacker gained access to my system, they could attempt to brute-force my database. Better safe than sorry.Tick the "Password" box and enter a strong password in the password field. I suggestusing Diceware to create this password, since it's imperative for this one to be super strong and random.Next, tick the "Key file" box (if you intend to use a key file) and click the "Create" button. You will be prompted with a save dialog. Select a location on your drive and save the key file—KeePassX will then generate the key file for you. If you are happy with your settings, click "OK" to continue.Step 3: Add Groups to Your DatabaseWe now have a fresh key database, but we don't have any groups other than the default "Root" group, which houses everything. Groups are basically just folders to organize your passwords in whatever manner you want.Since only having a "Root" group is extremely disorganized, we'll go ahead and create some more groups to keep things nice and tidy. Control-click (or right-click) on the folder labeled "Root" and select "Add new group." You could also select "Groups" in the menu bar and select "Add new group."Fill out the name field, add notes if you need them. If you have a password revocation policy, tick the "Expires" box and enter a date and time. Keep in mind that this will expire all passwords in that group at that time, and will remind you to select new ones.When you are done editing a group, click on the "OK" button on the bottom-right of the window.If you want more groups, go ahead and create them. You can also create subgroups within groups, if you want to be really OCD about them.Step 4: Add EntriesNow that we have some groups, it's time to start generating some credentials.Select a group, then pressCommand Nor go to "Entries" in the menu bar and select "Add new entry." Enter the title, your username, and click on the "Gen." button to generate a new password. Here you will be able to select password rules. I selected the special characters button in the character types, but you can use whatever you want—just hit "Accept" when it's to your liking.Fill out the rest of the fields as you see fit, then click the "OK" button at the bottom of the window to save your entry.Repeat these steps for all of the credentials you have and you will have unique, strong passwords for all of your accounts! Not necessarily as strong asDiceware passwords, but they're the next best thing.Step 5: Use the DatabaseIn order to use a stored password, simply select the entry you need and pressCommand Cto copy your password. Then useCommand Vto paste the password into the appropriate field of the website, app, etc. You don't have to worry about the contents of your clipboard being read due to KeePassX auto-clearing the clipboard after 10 seconds. While KeePassX does offer an autofill option, it is still in experimental state and beyond the scope of this article.Stay Tuned for More Hacking with Mac Guides!If you've beenfollowing along with the series, you now have a solid foundation to start building up from. Your hard drive is encrypted, and your credentials are safe. Coming up next, we'll be getting familiar with the terminal, getting package management working, and working with vim, eventually culminating in a strong hacking environment based on macOS.Next Up:How to Install iTerm2 Using the TerminalFollow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byMile Atanasov/123RF; Screenshots by Barrow/Null ByteRelatedMac for Hackers:How to Get Your Mac Ready for HackingNews:8 Tips for Creating Strong, Unbreakable PasswordsHacking macOS:How to Dump 1Password, KeePassX & LastPass Passwords in PlaintextHacking macOS:How to Dump Passwords Stored in Firefox Browsers RemotelyHow To:Enable Two-Step Verification on Your Apple ID for iCloud, App Store, & iTunesMac for Hackers:How to Create an Encrypted Disk ImageHow To:Easily Bypass macOS High Sierra's Login Screen & Get Root (No Password Hacking Required)Mac for Hackers:How to Install iTerm2 Using the TerminalHow To:Hack into a Mac Without the PasswordHow To:Dashlane & LastPass Can Now Automatically Strengthen All of Your Weak PasswordsHow To:Protect Yourself from the Biggest Jailbreak Hack in HistoryMac for Hackers:How to Enable Full Disk Encryption to Protect Your DataAdvice from a Real Hacker:How to Create Stronger PasswordsHow To:Get Your Hacked Facebook Account Back.How To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Hack Open Hotel, Airplane & Coffee Shop Wi-Fi with MAC Address SpoofingHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHow To:Protect Yourself from macOS High Sierra's Glaring Empty-Password Security FlawHow To:Disable Password Prompts When Downloading Free Apps in the Mac App StoreHow To:The Beginner's Guide to Defending Against Wi-Fi HackingNews:Malware Targets Mac Users Through Well-Played Phishing AttackHow To:Hack Mac OS X Lion PasswordsHow To:How Hackers Take Your Encrypted Passwords & Crack ThemHow To:How Hackers Steal Your Internet & How to Defend Against ItMastering Security, Part 1:How to Manage and Create Strong PasswordsGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingHow To:Bypass a Local Network Proxy for Free InternetGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingSecure Your Computer, Part 2:Password-Protect the GRUB Bootloader on Dual-Booted PCsRainbow Tables:How to Create & Use Them to Crack PasswordsHow To:Chain VPNs for Complete AnonymityGoodnight Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingHow To:Hack Wireless Router Passwords & Networks Using HydraHow To:Create Strong, Safe PasswordsGoodnight Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 7 - Legal Hacker