Ask HN: What password manager do you use?

Password managers are flawed by design. A master password grants access to all other passwords and creates a single point of failure. I also advise using separate email addresses to avoid having an additional single point of failure.

Have one email primarily for social interaction and create new emails when creating new accounts on new websites with new passwords.

I'll stick with using my own head. Even if that means I'm sending a password recovery request at least once a month from forgetting my passwords and then playing "Guess the Email that was just sent to" for the next 15 minutes.

Chances are if I forget my login, the site wasn't very important to me anyway and it's one less place I'll visit.

Re: Ask HN: What password manager do you use?

#8

Post by snowwrestler » Sat, Apr 25, 2015, 2:43 AM UTC

Nadya wrote: post #7

Password managers are flawed by design. A master password grants access to all other passwords and creates a single point of failure. I also advise using separate email addresses to avoid having an additional single point of failure. Have one email primarily for social interaction and create new emails when creating new accounts on new websites with new passwords. I'll stick with using my own head. Even if that means…

You're worried about the password for a website, so you create a new email account to handle its password recoveries. Now you have 2 passwords to worry about.

In cryptography, a single point of failure is what you want, because you can concentrate entropy at that point. Take 5 of the best passwords you can remember; concatenate them and use that as your master password. A 40+ character password from the full set of symbols will not be guessed anytime soon, even for astronomical values of "soon."

This is a net win because with a password manager, ALL your passwords can be 40+ characters if you want; you only have to remember one of those. Plus you can reduce the chance of needing to use email reset (which is itself incredibly insecure) to near zero.

Re: Ask HN: What password manager do you use?

#9

Post by Nadya » Sat, Apr 25, 2015, 3:02 AM UTC

snowwrestler wrote: post #8

Nadya wrote: post #7

Password managers are flawed by design. A master password grants access to all other passwords and creates a single point of failure. I also advise using separate email addresses to avoid having an additional single point of failure. Have one email primarily for social interaction and create new emails when creating new accounts on new websites with new passwords. I'll stick with using my own head. Even if that means…

You're worried about the password for a website, so you create a new email account to handle its password recoveries. Now you have 2 passwords to worry about. In cryptography, a single point of failure is what you want, because you can concentrate entropy at that point. Take 5 of the best passwords you can remember; concatenate them and use that as your master password. A 40+ character password from the full set of s…

A single point of failure means if they gain access to one account they have access to ALL of your accounts. For example, if someone breaks into your email and you use that email for all of your accounts (banking, amazon, facebook, etc.) they can use email recovery to gain access to ALL of your accounts.

If someone gains access to one of my accounts, every single other account is still secure because it uses an entirely different email & password that has no relation to any other email or password.

Re: Ask HN: What password manager do you use?

#10

Post by snowwrestler » Sat, Apr 25, 2015, 7:46 PM UTC

Nadya wrote: post #9

snowwrestler wrote: post #8

Earlier quoted context omitted.

You're worried about the password for a website, so you create a new email account to handle its password recoveries. Now you have 2 passwords to worry about. In cryptography, a single point of failure is what you want, because you can concentrate entropy at that point. Take 5 of the best passwords you can remember; concatenate them and use that as your master password. A 40+ character password from the full set of s…

A single point of failure means if they gain access to one account they have access to ALL of your accounts. For example, if someone breaks into your email and you use that email for all of your accounts (banking, amazon, facebook, etc.) they can use email recovery to gain access to ALL of your accounts. If someone gains access to one of my accounts, every single other account is still secure because it uses an entir…

> If someone gains access to one of my accounts, every single other account is still secure

All of your accounts are insecure from the start because a) you use passwords easy enough for you to remember, and b) you rely on email reset, which travels the public Internet in plain text.