4. Warnings

Things to consider.

4.1 Cleanups that need doing

It is entirely possible that there are some web sites out there with password requirements that this program cannot (at present) necessarily comply with. There are some possible workarounds:

1. Request the addition of a new character classification flag. If the issue can be satisfied by fiddling the emitted password a little bit (with the --use-pbkdf2 option), that would be faster and easier than implementing a new option.
2. Likely, something else, surely. Please send a bug report (preferably a patch :) so the issue can be fixed.

4.2 Shell history

It is imprudent to leave your invocations in your shell history. These are often stored away in your home directory, unless you do something to keep it out of your history. It should not be the end of the world because it is troublesome to also obtain the configuration file. Still, it is not wise to tempt fate.

If you use BASH for your shell,

HISTCONTROL=ignorespace:ignoredups
HISTIGNORE=gnu-pw-mgr *
unset HISTFILE

are your friends. Press the space bar before the command name, or specify that anything that looks like a “gnu-pw-mgr” command should be ignored or eliminate history entirely.

Also, if you put your password id’s on the command line, they become part of the process history and can be found. If that is a conceivable problem, then you may prefer to not put it on the command line and then type it in in response to a prompt. Your password id will not be echoed back as you type it.

4.3 Best gnu-pw-mgr practices

Try out several password id transforms before changing all your passwords on all your sites. You may decide it is too hard or too easy and want to change it. However, once you have gone to the trouble of changing the passwords on a lot of sites, you won’t be especially eager to do it again. So, play with it on one site you use a lot, change the password a lot as you change the transform and then make a good decision.

Once you need to or are required to change a password, simply specify a new “–use-pbkdf2” value for that password id. You may see its current value by specifying “–status”.

When choosing your password id transform, use things that you can easily remember. Especially if some nonsense thing can be easily remembered. Separate the components with unusual things like multiple punctuation characters. Do odd things with the top level domain. cApitaliZe strangely. Use a slightly different transform for financial institutions. If someone gets ahold of your seed file, you want to hope that a dictionary attack will not be readily successful.

But lastly and most important: be sure you can remember your transform(s). If you forget, your password is gone. So choose what you can remember and be consistent.

4.4 Password reset arrangements

Some sites will allow you to set up password resets using alternate channels (i.e. not your primary email address). Take advantage of this whenever possible. If someone gains access to your email, you don’t want them to reset all your passwords, intercept the restore access emails and, thus, gain access to all your password protected accounts.

This document was generated by Bruce Korb on June 30, 2018 using texi2html 1.82.