Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#231

Post by jones1618 »

As someone else did (deep in a comment thread), I'd recommend MemPa, an algorithmic password generator that uses one master password plus the site and your username to generate (or recover) your password.

Using MemPa (which is basically one line of JavaScript), your passwords are always hard to crack, retrievable with one password and yet never stored anywhere so there's no tempting honeypot for hackers to target.

The original article is here: https://hackernoon.com/mempa-a-modern-deterministic-password... (There are links to iOS and Android MemPa apps, too.)

I've also wrapped the algorithm in a single-page web app that you can copy to your own site or thumbdrive to make using the MemPa algorithm easier. https://codepen.io/jones1618/full/eeqBNG/

Re: Ask HN: Does anyone use an alternative to a password manager?

#232

Post by wonder_er »

SnowingXIV wrote: post #229
wonder_er wrote: post #185

Earlier quoted context omitted.

Hm. I just checked on both of these comments, and it seems 1password manages both quite well. re: password generation in-browser - this is working just fine for me. [0] And re: pw integrity or strength - this might not be everything you're looking for, but it's close. under a 'Security Audit' tab, it has categories for: - Watchtower (logins associated w/sites that are known vulnurable/exploited) - Weak Passwords - Du…

Wow, this is not at all what my screen looks like. Maybe it's the extension itself that's lacking? [0] I don't have any of these other options either. If I click on generate password the box just goes away. Maybe I should scrap the extension and just use the mac/windows application? I was reading a number of reports about not syncing between these. If I have both on maybe it'll cause issues? [0] https://imgur.com/a/m…

whoa. Something is not right indeed.

I'd delete the extension and re-install from AgileBit's website, and make sure the 1password app on mac is talking to the extension.

This is odd, but good luck! Obv. their support team would help square things away way better than this random internet stranger could!

Re: Ask HN: Does anyone use an alternative to a password manager?

#233

Post by SnowingXIV »

wonder_er wrote: post #232
SnowingXIV wrote: post #229

Earlier quoted context omitted.

Wow, this is not at all what my screen looks like. Maybe it's the extension itself that's lacking? [0] I don't have any of these other options either. If I click on generate password the box just goes away. Maybe I should scrap the extension and just use the mac/windows application? I was reading a number of reports about not syncing between these. If I have both on maybe it'll cause issues? [0] https://imgur.com/a/m…

whoa. Something is not right indeed. I'd delete the extension and re-install from AgileBit's website, and make sure the 1password app on mac is talking to the extension. This is odd, but good luck! Obv. their support team would help square things away way better than this random internet stranger could!

Thanks wonder_er! Apparently that did the trick. I'll give this a fair shake now and maybe my harsh comments will be irrelevant soon. :)

Re: Ask HN: Does anyone use an alternative to a password manager?

#235

Post by ktpsns »

laci27 wrote: post #218
ktpsns wrote: post #107

Earlier quoted context omitted.

I used pen and paper for a decade now. I have a folder and preprinted forms where I note passwords with pens. The folder had like 20 sheets. This worked pretty well and is without doubt the most secure variant -- I always have my folder with me. Note that this only stores the important passwords. I use weak and dumb passwords for non-important services (similar to disposable email boxes). Anyway I want to change to a…

I have a friend who does the same, but a folder with password is not encrypted. If it's stolen, or you just leave it somewhere by mistake, or if you leave it on a table while you piss, byebye security... A hacker only needs your old yahoo password to hack everything else. Please use at least Keepass, it has a master password, it is encrypted all the time if you want, it can have browser integration, it can upload the…

That's true. However, in general I trust my environment so much more than "the whole Internet" which potentially can gain access to my systems. In fact, I don't think encrypting password managers (even in their simplicity such as https://www.passwordstore.org/) prevent typical use cases: If your home account is compromised, it is easy manipulate the workflow and subsequently decrypt your virtual password storage.

Re: Ask HN: Does anyone use an alternative to a password manager?

#236

Post by ythn »

ohthehugemanate wrote: post #131

I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…

> Compare it to an algorithm, where your attack surface is "every service." If one password is compromised, they all are.

My password for Amazon is "f3cfcb6ZUZ^". What's my algorithm?

Re: Ask HN: Does anyone use an alternative to a password manager?

#237

Post by ythn »

bradknowles wrote: post #221
ohthehugemanate wrote: post #131

I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…

Algorithmic password generation from a single master password works fine up to the point where it doesn’t. What happens when you run into a site that won’t accept your algorithmic generated passwords? Do you fall back to a traditional password manager? If so, then you’ve just increased your attack surface area by an order of magnitude. What happens when you need to change your master password because of a compromise,…

> What happens when you run into a site that won’t accept your algorithmic generated passwords?

You maintain a public file that has metadata that is meaningless to an attacker. Metadata such as min/max length restrictions, etc.

Re: Ask HN: Does anyone use an alternative to a password manager?

#238

Post by ythn »

oneeyedpigeon wrote: post #159
dpc94 wrote: post #88

Earlier quoted context omitted.

I have the same issue. My full password is over 20 characters, but some websites restrict to less than that or don't accept the special character that I use.

I take that as a warning sign not to use such a site.

re: most banks

Re: Ask HN: Does anyone use an alternative to a password manager?

#239

Post by ecesena »

v_lisivka wrote: post #196
aaraujo wrote: post #57

Earlier quoted context omitted.

Yes. But I do add a special characeter and/or a maj at a certain place when it is needed

Why not use base64 instead? 64 random characters are much better than 16. $ perl -e 'use Digest::SHA "sha256_base64"; print sha256_base64("master_password mail.google.com"), "\n";' g/sOxZfr2DFE12r8Gs/D0bhwat5kku41L+kFmuCCQOo

That's what I ended up for MemPa (described above). The idea is that I can't read binary sha256 output, and everything I know that can translate in hex can also translate in base64 leading to shorter secrets.

For the special chars, I chose the Safari way of encoding, i.e. I only extract alpha-numberics from base64, and add a "-" every 3 chars. This also improves readability. I assume that if Apple chose this way of doing, either they studied it and/or sites will conform to that.

Re: Ask HN: Does anyone use an alternative to a password manager?

#240

Post by ryan-c »

jhasse wrote: post #160
ryan-c wrote: post #145

Earlier quoted context omitted.

The specific tool mentioned uses a trivial scheme. If I were trying to crack a large breach, I'd probably try running a few billion master passwords with that algorithm.

If you master password is weak, I don't think that bcrypt/scrypt in my tool would help when a breach has happened.

It absolutely would.
Post reply on HN