WangLu's Notes

[Updates 2025-01-20] The original blog post assumes that all passwords are stored in one password manager, and the password manager either unlocks everything or nothing (e.g. Keepass). After discussing with friends, I realized that if I use something like pass , and I use a hardware GPG token, I can actually store and sync all encrypted passwords to all devices, because I will only decrypt the passwords on demand, and the computer will not see the GPG private key. The compromise is that the computer will see the list of all password entries (e.g. accounts), as well as a few other issues . I've been using Keepass for many years. I don't use online password services because I cannot fully trust them. Besides, I may not always have Internet connection, which is why I also don't use a self-hosted service. Everything has been working fine, until I turn my paranoid knob to the max. Here's the thought experiment . The Imaginary Scenario Let's say I have 100 PCs for differe...

Every month I receive ~5000 spam emails. I am not very surprised, knowning that my email addresses appear in ~20 data breaches. Email providers filtered out most of them, but after filtering I still receive ~100 every month. It is very annoying when I'm interrupted by an email notification, only to realize that it's from a spam email. Meanwhile I cannot just disable all notifications. Three months ago, I started to try to improve the situation. First of all I explored options for email aliases . Then in the past 3 months, I have been manually reviewing all email messages in the inbox. That are in total ~70k messages. Basically I'm creating a whitelist of senders, and I only enabled notifiation for allowed messages. This turned out to work quite well, I can clearly feel the improvement of life quality. Occassionally I may still need to manually review other messages, but that's OK. Meanwhile, I took this opportunity to review all accounts that I have previouly registered...