Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 320 posts

Re: Ask HN: What is your password management solution?

#101

Post by iimpact »

dannysu wrote: post #38
rhlala wrote: post #37

Earlier quoted context omitted.

Why not use dropbox? It is only used for sync databases, not access them, I always though if someone found my keypass database encrypted it would be useless.

Paranoia Yeah, the KeePass database is encrypted and I secure it with both password and keyfile, but I still want something that won't leave my database "out there" available for bruteforce attempts or other attempts at it.

you can also encrypt the db file it self (before putting it on dropbox) with something like EncFS.

Re: Ask HN: What is your password management solution?

#102

Post by [deleted] »

dheera wrote: post #86
dagenix wrote: post #81

Earlier quoted context omitted.

Disadvantage: If any website you use has it's password database leaked, an attacker can then do an offline brute force attack to recover your master password. Then, the attacker can then generate your password to every other site you use, such as banks and email, just by trying a couple values of n.

That's the point of using PBKDF-HMAC-SHA256. As long as your master password is strong it's not going to be brute forceable for the forseeable future.

[deleted]

Re: Ask HN: What is your password management solution?

#103

Post by dheera »

dagenix wrote: post #100
dheera wrote: post #86

Earlier quoted context omitted.

That's the point of using PBKDF-HMAC-SHA256. As long as your master password is strong it's not going to be brute forceable for the forseeable future.

My point is that this is dangerous. The security of this method is equal to the strength of you master password + the least secure website you use. If that website has a password breach, the only thing standing between an attacker and a compromise of every website you use is the strength of you master key. (And GPUs are pretty good at brute forcing PBKDF2 - so it has to be really strong.) This is unlike a stateful pa…

> The security of this method is equal to the strength of you master password + the least secure website you use.

Not exactly. It's equal to the strength of your master password only. Even if one of your passwords leaked, this function does not compute fast enough in the forseeable future to brute force your master password, as long as your master password is strong.

> And GPUs are pretty good at brute forcing PBKDF2 - so it has to be really strong.

Interesting, thanks for telling me this. But how much better? I mean, a GPU with 1024 CUDA cores surely cannot surpass 1024 CPUs. So all we need to do is bump up 100000 to a slightly higher number to make it GPU-proof if that's the case, no?

> There the security of the system is related to the strength of your password + the strength of the security of the place you store your password db. If you pick a place that is serious about security, your almost certainly better off.

The problem is that it's difficult to find some places that is serious, and that you trust to be serious. Most people will end up putting it on Dropbox or Google Drive because there isn't anything else that is accessible to them and easy to use on a phone. Also, what if you're on vacation, PC rendered in an unbootable state, and you need to reinstall your OS? This has happened to me at least 3 times.

Re: Ask HN: What is your password management solution?

#104

Post by dheera »

rocqua wrote: post #91
dheera wrote: post #83

Earlier quoted context omitted.

I memorized 1024 digits of pi in high school. I can deal with a strong password. Keep in mind that most password managers also encrypt your password database with your master password, so my solution isn't any worse than those. Memorizing a even a 16-character (upper/lower + symbols) random string as your master password would be 16*6 = 96 bits of entropy which is more than enough. Dealing with memorizing ONE good 16…

The standard password manager is slightly better because the password database works like a 2nd factor. Also, a character has at most 8 bits of entropy, not 64. If you use base 64 its only 6 bits of entropy. 16 x 6 = 96 bits is still more than enough though. A downside if everyone used this scheme would be parallelized attacks on reversing the hash for the key. If you find a key that, with this scheme, creates a pass…

Sorry early morning here, I actually fixed that before I saw your comment -- more like 6 bits per character. In any case more than good enough.

I actually am not a fan of 2nd-factor authentication (e.g. phone). If you lose the physical thing or it gets leaked to a stranger, gunman who mugs you, leaked by security holes in the thing's own embedded OS, it's no longer helping your security. I'd rather authentication depend on only what's in my mind and body and nothing external. Also, I lose stuff and forget stuff pretty easily, so I often just avoid carrying anything.

Re: Ask HN: What is your password management solution?

#105

Post by dannysu »

iimpact wrote: post #101
dannysu wrote: post #38

Earlier quoted context omitted.

Paranoia Yeah, the KeePass database is encrypted and I secure it with both password and keyfile, but I still want something that won't leave my database "out there" available for bruteforce attempts or other attempts at it.

you can also encrypt the db file it self (before putting it on dropbox) with something like EncFS.

I used to do that when I used purely Linux. However, once you bring iPhone and Windows into the picture it doesn't work anymore.

Re: Ask HN: What is your password management solution?

#106

Post by dheera »

abrkn wrote: post #89
dheera wrote: post #83

Earlier quoted context omitted.

I memorized 1024 digits of pi in high school. I can deal with a strong password. Keep in mind that most password managers also encrypt your password database with your master password, so my solution isn't any worse than those. Memorizing a even a 16-character (upper/lower + symbols) random string as your master password would be 16*6 = 96 bits of entropy which is more than enough. Dealing with memorizing ONE good 16…

Which technique did you use? I made it to around 150 using the memory palace technique from the excellent book Moonwalking with Einstein.

I'm not sure what the various methods are called or what they are -- never really researched it. I just memorized about 10 digits every day over the course of a summer. Every day I practiced typing out the entire thing a few times as well as practiced the most-recent 100-block several more times.

Re: Ask HN: What is your password management solution?

#107

Post by prophesi »

weinzierl wrote: post #73
dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...

"Pretty much anything that can be remembered can be cracked."

Randomly choose 6 words from a 10k English dictionary and you're set. Hell, make it 12 words. Still insanely easier to remember than a 12 character alphanumeric/symbol password, and much more difficult to crack.

Re: Ask HN: What is your password management solution?

#108

Post by tuxxy »

weinzierl wrote: post #90
dheera wrote: post #83

Earlier quoted context omitted.

I memorized 1024 digits of pi in high school. I can deal with a strong password. Keep in mind that most password managers also encrypt your password database with your master password, so my solution isn't any worse than those. Memorizing a even a 16-character (upper/lower + symbols) random string as your master password would be 16*6 = 96 bits of entropy which is more than enough. Dealing with memorizing ONE good 16…

I don't question your memory, that is not my point. How long do you think it takes to crack a password that consists of digits of Pi or anything derived from it? And it's not about Pi either, it's just that you can't beat a computer in that regard. For me, playing around with hashcat, was an eye opening experience and I truly believe in the Schneier quote from above.

I agree with Schneier's quote, but you're also forgetting about password hashing. If it takes 10 seconds to derive the key (assuming the use of a strong hash function), anything with a good enough amount of entropy (60-90 bits) should be fine.

When an attacker acquires a leaked database, they're not cracking high entropic passwords.

Re: Ask HN: What is your password management solution?

#110

Post by kijin »

takeda wrote: post #46
jzast2 wrote: post #17

https://www.lastpass.com Free to use, auto password generation, has an iOS app with thumb print unlock (saves you from typing in a long master password). I personally really enjoy it.

My company uses it and I really despise it. Basically their web add-ons are extremely buggy. I was using Firefox and after many issues tried Chrome version, that one looks nicer but is similar POS and similarly had its own set of issues. Perhaps I would be happier if there was just a standalone app that I would only fire up when I need it.

I agree. The browser plugins used to be much cleaner and snappier when I first started using LastPass a few years ago, but it has progressively gotten worse to the point of making the whole thing nearly unusable. It feels like some 4th grader tried to reimplement drop-down menus using a crappy home-made JS framework.

I stayed with LastPass through the various security incidents they've suffered, but recent UI updates finally made me cancel my paid subscription and switch to 1Password -- a standalone app that integrates with the browser through a very lightweight plugin.

Post reply on HN