Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage your passwords?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 92 posts

Re: Ask HN: How do you manage your passwords?

#61

Post by mtry1 »

Keeper - https://keepersecurity.com/

I've tested just about every password manager because it was up to me to choose the most secure one for my company after we noticed some suspicious activity going on.

There a few products I liked, but I can say unequivocally that Keeper is the best solution for IT folks. It's hands down the most secure and it's the most intuitive for people of all backgrounds.

Keeper generates 256-bit encryption keys using PBKDF2 with HMAC-SHA256 and a minimum of 1,000 rounds, and user data is encrypted with 256-bit AES ciphers. They're a zero knowledge platform, so the cipher keys to encrypt and decrypt user records are not stored or transmitted to the cloud.

Works on every browser and platform, including Linux.

They have all of the standard password management features as well, like autofilling logins, generating random, complex passwords, two-factor auth, fingerprint login, etc... It's made my life a lot easier.

Re: Ask HN: How do you manage your passwords?

#62

Post by Old_Crow »

Keeper: 256 bit client side encryption to Amazon S3. You can save passwords, files, autofill website logins, fastfill to apps on android. Easy to share info between other Keeper users. The app has a password generator and a strength meter. All you need to remember is your master password. Free if you only use it on one device, $9.99 if you sync it to the cloud and use it on another device.

Re: Ask HN: How do you manage your passwords?

#64

Post by toki5 »

My muscle memory is astonishingly strong (probably from two decades of classical piano training).

I use this to my advantage with passwords: When I need to generate a new one, I play a "song" into Notepad (or vim as the case may be). Not a known song, but a seemingly random string of glyphs that make sense in my head at the time.

Practicing typing that string forms a powerful association with that account/website and that "song," and my hands remember it for the rest of my life.

The one big drawback to this is that it's nearly impossible for me to enter passwords on my phone without having a keyboard handy and arduously trying to recreate the string. Also, changing a password (not that I usually need to) is a little difficult because I have to retrain myself.

The advantages are: They're not written down anywhere; I don't have to struggle to remember which permutation of some base string I used this time; they don't follow any sort of pattern.

Re: Ask HN: How do you manage your passwords?

#65

Post by davegauer »

JshWright wrote: post #13
boydjd wrote: post #10

keepass. I don't trust a service to store my passwords. I use a key file and a passphrase to secure my keepass database. The database is stored on dropbox, the keyfile is stored elsewhere.

Same here. KeePass2 on Linux, KeePassX on OSX, and KeePassDroid.

I've had a _great_ experience using KeePassX on both Windows and Linux.

I use a sometimes-synced copy of the database on KeePassDroid on my Android phone. Actually, the user experience of KeePassDroid can only be described as vile, but that it works at all (allowing me to have all of my passwords securely available on my person) is awesome enough.

Re: Ask HN: How do you manage your passwords?

#66

Post by Old_Crow »

mtry1 wrote: post #61

Keeper - https://keepersecurity.com/ I've tested just about every password manager because it was up to me to choose the most secure one for my company after we noticed some suspicious activity going on. There a few products I liked, but I can say unequivocally that Keeper is the best solution for IT folks. It's hands down the most secure and it's the most intuitive for people of all backgrounds. Keeper generates 256…

My wife and I use this. I have an android phone and she has an iphone. We share records back and forth and she really likes the touch id quick login.

Re: Ask HN: How do you manage your passwords?

#67

Post by cwt »

enoch_r wrote: post #47
chrisparsons wrote: post #22

Earlier quoted context omitted.

I started using Lastpass when I switched jobs and the company I moved to used it. The ability to share logins with people/groups without actually exposing the password is wonderful in the corporate setting, as it makes revoking a group of passwords (think company-level social media accounts) simple and worryfree. It works well enough to have convinced me to buy Premium on my personal account.

> the ability to share logins with people/groups without actually exposing the password is wonderful in the corporate setting I haven't tried this for a long time, but the last time someone shared a password with me through LastPass, I was able to easily grab the plaintext just by watching the network traffic with dev tools. So this feature seems questionable to me.

IMO, if you're "sharing" a password it should be visible to the sharee. Then, if you revoke it just change it - last pass knows how to make passwords

Re: Ask HN: How do you manage your passwords?

#68

Post by UnoriginalGuy »

cwt wrote: post #2

I use lastpass. Never tried any other password manager. I don't mind logging into it. On my phone I can swipe my thumb. The only thing I don't like is having to type out the long random passwords on non-physical-keyboards - like setting up a roku to connect to amazon play and spending an extra 15 clicks switching case/keyboard. How often do you have to log into it? Is it specific to a device?

I like that I can open up an incognito window in Chrome at work, login to LastPass, have access to many things, then when the window closes, I log out, or shut the machine down then I am logged out.

I do have Google Authenticator tied to it, so logging in once a day is a little annoying, but overall it is a good experience.

I have the phone app (LastPass Premium) and while it is fine, it is a little buggy/annoying/meh. I haven't decided if I'm going to renew or not. I don't really blame the company for the limitations, they're trying to work around heavy app sandboxing, but after it all the user experience remains subpar.

Overall I would recommend it. In particular if you use Google Authenticator with it and a very solid master password.

Re: Ask HN: How do you manage your passwords?

#69

Post by UnoriginalGuy »

boydjd wrote: post #10

keepass. I don't trust a service to store my passwords. I use a key file and a passphrase to secure my keepass database. The database is stored on dropbox, the keyfile is stored elsewhere.

This is very close to how LastPass works under the hood. You're storing an encrypted database on their service (just like DropBox in your case). They don't actually store your original master password.

The only legitimate security gripe I've ever read about LastPass (and people have focused its security a LOT) is that a bad guy can modify the JavaScript utilised by the extension if they took control of LastPass's servers, and have your plain text master password sent to a third party (assuming no cross-site protections).

The actual password database is fairly secure. As is the login process (which can further be strengthened with 2F and various options in the account settings).

Post reply on HN