Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#121

Post by ohthehugemanate »

Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

What do you do for forced password change requirements?

Does your threat model include anything NOT bulk, ie where a human would see a password and guess the pattern?

Have you tried any of the password managers that have integrations, to automate password changes in case of failure?

Have you ever heard of the security concept of minimizing your attack surface?

Re: Ask HN: Does anyone use an alternative to a password manager?

#122

Post by wonder_er »

whalesalad wrote: post #108
wonder_er wrote: post #106

I'm surprised at how little advocacy there is for 1password. Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm . It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account. If anyth…

My wife and I do the same which is hugely convenient. You can store more than website logins as well, such as credit card numbers, drivers license details or our passport information. We do a lot of travel and financial witchcraft so having full access to each other’s into at the unlock of a thumbprint is extremely convenient. We also have a team vault at FarmLogs which is hugely helpful for sharing access to singula…

precisely! I make heavy use of 1pass document storage to keep high-quality PDFs of:

* passports

* drivers licenses

* birth certificates

* visas

* proof of residency

* vaccination records

* bank paperwork

* etc

We're in the same boat. We travel a lot, often for extended periods of time, and both work fully remotely. Any document anyone could want from me, for any reason, lives in 1password.

They could double the price, and I'd gripe a little, but would never imagine walking away from the tool.

(er, 1password, don't double your prices, if you're reading this.)

edit: formatting

Re: Ask HN: Does anyone use an alternative to a password manager?

#123

Post by h4waii »

rrebelo wrote: post #110
tarruda wrote: post #52

An idea for a side project I had for some time: Use Raspberry Pi Zero connected to the PC as a password manager . Explanation: RPi Zero supports OTG and can emulate USB keyboard (in other words, it can "type" your passwords for you). Never got too deep into this idea, but it shouldn't be extremely hard to implement. Need to create some mechanism to allow the web browser to ask the RPi for a password for a certain sit…

Funny, I am doing something like that now, but using an smartphone with a fingerprint reader, instead of a Pi and sending the password through Bluetooth (adding USB might be a good idea, though). My problem with the Pi is that it is another bulky device to carry or loose, even the Pi Zero. My implementation still has lots of security breaches and I don't want to publish something so fragile. I still need to implement…

Since you're already using a phone for this, why not just use Keepass2Android USB Plugin [0] which emulates a keyboard and "types" the password. Requires Android, and probably a device with kernel modules for USB HID.

You won't have to worry about the security and integrity of your Bluetooth connection and the risk of an external sniffer -- but you'll have consider if you trust the computer you're plugging it in to.

0. https://github.com/whs/K2AUSBKeyboard/

Re: Ask HN: Does anyone use an alternative to a password manager?

#124

Post by JoeAltmaier »

Used to have a car with a digital lock; every time you exited, you punched a code to lock, punch again to unlock when you return.

Most folks would just give up and punch 1111 or some such. Instead I used the address where I'd parked. Didn't have to remember; didn't have to invent anything; different code fore every place I went.

Re: Ask HN: Does anyone use an alternative to a password manager?

#126

Post by tigroferoce »

wonder_er wrote: post #120
exhilaration wrote: post #112

Earlier quoted context omitted.

I've been happily using 1Password 4 for many years, my credentials are encrypted and synced via Dropbox. But I hear the latest versions require you to use their cloud service, the self-hosted version is no longer available. Is that true? I use 1Password for not only credentials but as a document vault for everything from passports, birth certificates, anything else that falls under "needed after the house burns down"…

This is accurate. I migrated to the cloud service when I wanted to add my wife to my account. It was not an elegant process, and the friction kept me from following through for more than a few months. I finally pulled the trigger, spent the time and hassle migrating everything, and am now glad that I did.

Also, you don't want the freemium business model because:

1) passwords are a serious stuff, so you want serious people to to some serious work behind your PM (AKA, it can't be free); 2) passwords are a too fundamental tool of our digital existences to have a monthly-based subscription. The idea of being locked out of your services when you can't afford to pay the monthly fee is just horrible.

Re: Ask HN: Does anyone use an alternative to a password manager?

#127

Post by ryan-c »

Kequc wrote: post #119
jhasse wrote: post #102

I use https://bixense.com/pwcalculator/ (GUI for hashing alias + site) and dedicated passwords for services I need to access more often.

This seems to me like a very clean solution, is there a Chrome extension version of something like this? I'd love to tap on a password field, enter my secret key, and have it autofill based on the domain of the page.

If someone suspects such a solution is being used, they can attempt to crack the master password. Combined with the weakness of this not supporting forced password rotation or varying complexity requirements well, it's really not a good solution.

Re: Ask HN: Does anyone use an alternative to a password manager?

#128

Post by mason55 »

rockostrich wrote: post #118
Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to and even realize that your password has some sort of generation algorithm, but it would be a bit more secure to hash that password in some way. That's why I like using LessPass (even though people talk a bit of shit about it whenever it's mentioned on HackerNe…

It’s very unlikely anyone will take the time to figure out your pattern unless you’re a high value target. If your password just gets exposed as part of a credential dump among 100 million others then the thieves will automate their attempts to try your password other places and it will fail.

If you’re a high value target then you shouldn’t do this

Re: Ask HN: Does anyone use an alternative to a password manager?

#129

Post by mattferderer »

Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

I'm a fan of mixing this idea with something like 1Password. Obviously depending on the application, the security increases or decreases. My approach is to memorize multiple base passwords though & then mix it with some random gibberish. So I might write my password down like this:

KXl2h!H (H)

That would tell me that the password is KX12h! plus whatever the base password for H is. My hope is that unless someone was really targeting me, I would be skipped over as not worth the effort.

This way, even if someone broke into 1Password or one of my other password managers, they still wouldn't have the password.

The part I struggle with most, is how/where to store these & Authy/Google Authenticator tokens in a manner that they can be delivered to specific people in the case of my death without decreasing security.

Re: Ask HN: Does anyone use an alternative to a password manager?

#130

Post by wonder_er »

tigroferoce wrote: post #126
wonder_er wrote: post #120

Earlier quoted context omitted.

This is accurate. I migrated to the cloud service when I wanted to add my wife to my account. It was not an elegant process, and the friction kept me from following through for more than a few months. I finally pulled the trigger, spent the time and hassle migrating everything, and am now glad that I did.

Also, you don't want the freemium business model because: 1) passwords are a serious stuff, so you want serious people to to some serious work behind your PM (AKA, it can't be free); 2) passwords are a too fundamental tool of our digital existences to have a monthly-based subscription. The idea of being locked out of your services when you can't afford to pay the monthly fee is just horrible.

agreed! In their defense, the old model wasn't freemium, it was a one-time fee. (I think it was $40 or $50 when I bought it.)

That said, over the time horizon of many years, $40 doesn't cover much at all. For the reasons you mentioned, I felt a sense of relief when I moved over to the monthly model.

Post reply on HN