Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#211

Post by ateesdalejr »

encima wrote: post #15

I use a simple 'cipher' that makes new passwords easy to remember and remains relatively secure without the need of a book/service. I have a file of the first word that comes to mind for every letter in the alphabet. Then my password is created based on some features of the site. I.e. eBay has 4 letters so I could choose: 'Elephant_4_Yankee' The delimiter is up to you and you could just as easily choose every second…

Only problem is this would allow some pretty simple dictionary attacks if you use the method described.

Re: Ask HN: Does anyone use an alternative to a password manager?

#212

Post by wyqydsyq »

Don't store your passwords anywhere, have them be determined by generating a unique password based on the service name and a master password with an added salt, this is similar to other proposed algorithm methods except more secure because your unique salt is used in addition to your master password, so even if someone guessed/learned your master password (e.g. social engineering) they would not be able to generate the same result passwords for services without your unique salt that's only located on your device(s) which should (hopefully) be physically secure.

This way you only need to remember one password (master) to re-generate your password for any given service, and nobody can replicate the resulting service passwords without knowing BOTH your master password and your salt.

I wrote a proof of concept a few years ago, it's pretty outdated and generating word phrases would be better than just hashes, but it conveys the idea: https://github.com/wyqydsyq/ysnp

Re: Ask HN: Does anyone use an alternative to a password manager?

#213

Post by barrkel »

barrkel wrote: post #153
drdaeman wrote: post #92

Earlier quoted context omitted.

This works, but doesn't scale. The problem is, the login form doesn't remind that a) a special character was required and b) what characters that particular site thinks are "special".

FWIW, it's really rare for a mixed-case alphanumeric password to be rejected. Typically it's only banks and corporate logins. Those are sufficiently special-case to make an exception.

Downvoted! :) Amusing for actual lived experience to be denied!

(Data: I have 72 logins currently cached in Firefox. Every single one of those sites accepts 10-character mixed case alphanumeric passwords with no extra special character requirements. About once a year I come across a site that needs one.)

Re: Ask HN: Does anyone use an alternative to a password manager?

#214

Post by soccerdave »

ecesena wrote: post #207
ohthehugemanate wrote: post #131

I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…

I think you're assuming that the algorithm must be reversible, but I don't see why. For example, hash(site|strong_master_password) isn't reversible under reasonable assumptions. If the algorithm is not reversible, "one password is compromised, they all are" isn't true. Only if the master password is compromised, then all your passwords are (but this is exactly the same with any password manager.) The one thing that p…

In your scenario, what happens if you need to change strong_master_password? I’m assuming you now need to change every password on every single site or else remember your new strong password and your old.

Re: Ask HN: Does anyone use an alternative to a password manager?

#215

Post by xkcd-sucks »

kinkrtyavimoodh wrote: post #206
ohthehugemanate wrote: post #131

I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…

It doesn't make sense to talk of an attack surface without talking about the kind of attack. Unless you are a high value target, there is a pretty good chance no one is sitting specifically bruteforcing your passwords. Your biggest source of attack is then a password dump, where you are one of the many millions compromised and now your other accounts (if you reused the same password) are now vulnerable to automated a…

>Unless you are a high value target, there is a pretty good chance no one is sitting specifically bruteforcing your passwords.

But... I don't want advice from plebs, I want advice from big winners!

Re: Ask HN: Does anyone use an alternative to a password manager?

#216

Post by kinkrtyavimoodh »

xkcd-sucks wrote: post #215
kinkrtyavimoodh wrote: post #206

Earlier quoted context omitted.

It doesn't make sense to talk of an attack surface without talking about the kind of attack. Unless you are a high value target, there is a pretty good chance no one is sitting specifically bruteforcing your passwords. Your biggest source of attack is then a password dump, where you are one of the many millions compromised and now your other accounts (if you reused the same password) are now vulnerable to automated a…

>Unless you are a high value target, there is a pretty good chance no one is sitting specifically bruteforcing your passwords. But... I don't want advice from plebs, I want advice from big winners!

you are getting advice from big winners... for plebs :D

Re: Ask HN: Does anyone use an alternative to a password manager?

#217

Post by laci27 »

cJ0th wrote: post #190
laci27 wrote: post #63

Earlier quoted context omitted.

Why would you use an encrypted file when you have free, open source password managers like Keepass? Every time you login somewhere, you open the file, search for the site, copy the password and paste it in the browser? What do you do when you need a password on your phone? What do you do to clean your memory after the paste operation to reduce the likelyhood of memory trojans reading it?

> What do you do when you need a password on your phone? dl the file from dropbox and decrypt it via termux /s

How much do you get paid / hour? Cause that takes times. 5 minutes here, 5 minutes there and I guarantee you that if you do the math, you're wasting a lot of time doing stuff that password managers (online/offline/closed or open sourced) can do automatically.

Re: Ask HN: Does anyone use an alternative to a password manager?

#218

Post by laci27 »

ktpsns wrote: post #107
laci27 wrote: post #62

Earlier quoted context omitted.

rofl. I have around 1300 passwords in Keepass, most of them are 20 characters including symbols. Good luck writing those passwords every time you need to login...

I used pen and paper for a decade now. I have a folder and preprinted forms where I note passwords with pens. The folder had like 20 sheets. This worked pretty well and is without doubt the most secure variant -- I always have my folder with me. Note that this only stores the important passwords. I use weak and dumb passwords for non-important services (similar to disposable email boxes). Anyway I want to change to a…

I have a friend who does the same, but a folder with password is not encrypted. If it's stolen, or you just leave it somewhere by mistake, or if you leave it on a table while you piss, byebye security... A hacker only needs your old yahoo password to hack everything else. Please use at least Keepass, it has a master password, it is encrypted all the time if you want, it can have browser integration, it can upload the encrypted DB to the cloud..

Re: Ask HN: Does anyone use an alternative to a password manager?

#219

Post by ecesena »

soccerdave wrote: post #214
ecesena wrote: post #207

Earlier quoted context omitted.

I think you're assuming that the algorithm must be reversible, but I don't see why. For example, hash(site|strong_master_password) isn't reversible under reasonable assumptions. If the algorithm is not reversible, "one password is compromised, they all are" isn't true. Only if the master password is compromised, then all your passwords are (but this is exactly the same with any password manager.) The one thing that p…

In your scenario, what happens if you need to change strong_master_password? I’m assuming you now need to change every password on every single site or else remember your new strong password and your old.

If you have to change your master password, you have to change all passwords.

With a vault, if you ever “leaked” your vault file, it’s the same. To me, it’s hard to think to a realistic case where your master password is leaked, but you’re 100% sure your vault file is not.

Re: Ask HN: Does anyone use an alternative to a password manager?

#220

Post by bradknowles »

kinkrtyavimoodh wrote: post #206
ohthehugemanate wrote: post #131

I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…

It doesn't make sense to talk of an attack surface without talking about the kind of attack. Unless you are a high value target, there is a pretty good chance no one is sitting specifically bruteforcing your passwords. Your biggest source of attack is then a password dump, where you are one of the many millions compromised and now your other accounts (if you reused the same password) are now vulnerable to automated a…

No, but there is malware out there that specifically targets your password manager files.

So, that is totally a legit concern.

Post reply on HN