Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

271–280 of 320 posts

Re: Ask HN: What is your password management solution?

#271

Post by gkya »

dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

Yeah, in an ideal world... In the real world I'm coerced to use some apps and websites with shit security, and have to store stuff like PINs &c which impose a certain structure on the secret, and if I'm not misunderstanding, this can't help with that sort of secrets.

Re: Ask HN: What is your password management solution?

#272

Post by SAI_Peregrinus »

prophesi wrote: post #107
weinzierl wrote: post #73

Earlier quoted context omitted.

The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...

"Pretty much anything that can be remembered can be cracked." Randomly choose 6 words from a 10k English dictionary and you're set. Hell, make it 12 words. Still insanely easier to remember than a 12 character alphanumeric/symbol password, and much more difficult to crack.

Better yet, use the EFF's Diceware list. It's easy to pick randomly from the list (just roll some dice) and the resulting passphrase won't have some of the issues a dictonary chosen one would have, like compound words causing entropy reductions. (EG if fire, truck, and firetruck are included in the dictionary as 3 separate words and you happen to get fire and truck in sequence as part of your passphrase the entropy of those two words is equivalent to the entropy of a single word! Not good.)

Re: Ask HN: What is your password management solution?

#273

Post by mbrameld »

tptacek wrote: post #266
parent5446 wrote: post #263

Earlier quoted context omitted.

It doesn't matter whether he does or not. He's using your own argument against you. Stepping in here and saying, "don't worry guys I'm the expert, so don't ask any questions", is just pompous and doesn't actually convince anybody. Use logic to support your claims, not your resume.

No, sorry.

Are you able to say why you aren't willing to go in to details? I respect your CV and am going to switch to 1Password from LastPass based on your comment, but I'm curious whether I need to be concerned about my information being compromised.

Re: Ask HN: What is your password management solution?

#274

Post by gkya »

madhadron wrote: post #167

I still use a GPG encrypted org-mode file. Emacs/org-mode opens it seamlessly. I feel like I should move to Keepass at some point, but it's one of those cases where if I'm apathetic long enough, Keepass will be gone and I'll still have my Emacs setup.

I use pass nowadays but used to use org for passwords, but in my setup I used to only encrypt the contents of entries, i.e. headings were in plain text. Then I used the function below to decrypt them. Made it easier to browse the file.

  (cl-defun gk-org-decrypt-element ()
    "Decrypt the element under point, show in a new buffer."
    (interactive)
    (save-excursion
      (let ((transient-mark-mode t))
        (org-mark-element)
        (epa-decrypt-region
         (region-beginning) (region-end)
         (lambda ()
           (let ((decrypted-elem (org-get-heading t t))
                 (bufnam (buffer-name)))
             (prog1
                 (switch-to-buffer (get-buffer-create "*Org Secret*"))
               (read-only-mode -1)
               (fundamental-mode)
               (erase-buffer)
               (insert ">>> " decrypted-elem " (" bufnam ")")
               (newline)
               (insert ">>> Hit `Q' in order to *kill* this buffer.")
               (newline 2)
               (special-mode)
               (local-set-key [?Q] 'kill-this-buffer))))))))

Re: Ask HN: What is your password management solution?

#275

Post by tonyarkles »

tptacek wrote: post #266
parent5446 wrote: post #263

Earlier quoted context omitted.

It doesn't matter whether he does or not. He's using your own argument against you. Stepping in here and saying, "don't worry guys I'm the expert, so don't ask any questions", is just pompous and doesn't actually convince anybody. Use logic to support your claims, not your resume.

No, sorry.

It's funny. When I was the GP comment I thought "well that's not a very useful comment". Now that I've paid attention to who the author is... I'm getting concerned about LastPass :)

Re: Ask HN: What is your password management solution?

#276

Post by dagenix »

dheera wrote: post #103
dagenix wrote: post #100

Earlier quoted context omitted.

My point is that this is dangerous. The security of this method is equal to the strength of you master password + the least secure website you use. If that website has a password breach, the only thing standing between an attacker and a compromise of every website you use is the strength of you master key. (And GPUs are pretty good at brute forcing PBKDF2 - so it has to be really strong.) This is unlike a stateful pa…

> The security of this method is equal to the strength of you master password + the least secure website you use. Not exactly. It's equal to the strength of your master password only. Even if one of your passwords leaked, this function does not compute fast enough in the forseeable future to brute force your master password, as long as your master password is strong. > And GPUs are pretty good at brute forcing PBKDF2…

> Interesting, thanks for telling me this. But how much better? I mean, a GPU with 1024 CUDA cores surely cannot surpass 1024 CPUs. So all we need to do is bump up 100000 to a slightly higher number to make it GPU-proof if that's the case, no?

The weakness of PBKDF2 is that it requires a small fixed amount of memory to run, making it ideal for brute forcing with a GPU. Algorithms like Scrypt / Argon2 are designed to counter this by requiring lots of memory to run. Best reference I could find or current best GPU brute forcing speed is https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... - which seems to say that the test system could do like 100-200k password guesses / sec with PBKDF2-Sha256 @ 100,000 iterations (extrapolating from the numbers given).

Re: Ask HN: What is your password management solution?

#278

Post by markwhiting »

khn1 wrote: post #163
stirner wrote: post #133

I use iCloud Keychain on macOS and iOS. Both operating systems include a rudimentary interface for managing passwords, and automatically store passwords entered in Safari. Keychain Access on macOS also allows to create secure notes on iCloud Keychain.

iCloud Keychain works great for me. Although, if I could change one thing, it would be to add a dedicated iOS app, instead of having to go to Settings > Safari > Passwords.

Its somewhat easier in iOS 11, there's a more dedicated area in settings. Also, in iOS 11, it provides usernames and passwords within apps, which is super convenient.

Re: Ask HN: What is your password management solution?

#279

Post by carohuud »

I know a real professional hacker who has worked for me once in this past month. He is very good at hacking. He offers legit services such as clearing of bad records online without it being traced backed to you, he clones phones, hacks facebook,instagram,whatsapp,emails,twitter, bank accounts,FIXES CREDIT REPORTS, tracks calls. He also helps to retrieve accounts that have been taken by hackers. His charges are affordable, Contact brianhackwizard@gmail.com or text only (+1 571-286-5929)

Re: Ask HN: What is your password management solution?

#280

Post by nzealand »

I use firefox bookmarks synced using Xmarks.

Each account has a unique email address, and important accounts have a unique password element added.

I use firefox bookmarks to note down in a cryptic manner any variations to the common themes I use. The bookmarks are synced across computers.

The upshot is I always use firefox bookmarks to log in to a site, which means I am not clicking links from emails and I am always in an extension free browser.

Post reply on HN