Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#71

Post by notacoward »

kqr wrote: post #65
natch wrote: post #24

I have a couple scripts, 'add' and 'get', which respectively add or get an entry associated with some keys to a text file. An example line in the text file looks like this: facebook password: [base64:U2FsdGVkX1/T8CoWmfDOoaapE5lGj/fqHE3s8NohnriGajnPrCzWikCneU/u7] Anyone thinking of trying to crack that, well good luck. I removed and twiddled a few characters from it, as if it wasn't hard enough already. Oh but here's…

Why generate symbols that are not permitted anyway? You'd lose nothing by emitting the base16 encoding of the symbol.

The problem is that there is no character-type pattern - most especially not your base16 suggestion - that will satisfy every site. Many sites require special characters. Others forbid them. It's literally impossible to satisfy both with a single non-parameterized generator, and as soon as you start adding parameters those effectively become hidden parts of the domain name. Worse, many sites don't even tell you what the requirements are on normal entry (only on change). If you can't remember what particular tweaks were necessary then it's back to the good old "forgot my password" dance - making your email password your effective password for all such sites. It's easy for app developers to be careless or "clever" about their password rules, but it's a pain for users and it's bad for security.

Re: Ask HN: Does anyone use an alternative to a password manager?

#72

Post by yread »

aaraujo wrote: post #57
netsharc wrote: post #46

Earlier quoted context omitted.

So... your passwords are 15 characters of the combination 0-9, a-f?

Yes. But I do add a special characeter and/or a maj at a certain place when it is needed

Smart of you to use a throwaway account :)

Re: Ask HN: Does anyone use an alternative to a password manager?

#73

Post by didgeoridoo »

danicgross wrote: post #21

We really need passchange.js: an open source collection of headless JS scripts that can programmatically change your password on a given website. Then you would continuously rotate _all_ your managed passwords as well as your master. Not a panacea, but significantly minimizes the length of a theoretical breach.

This would be a great feature for 1Password to adopt.

I’m not sure what you mean by “as well as your master”, though. If your master password is programmatically changed, how would you be able to access any of your stored passwords?

Re: Ask HN: Does anyone use an alternative to a password manager?

#74

Post by QuadmasterXLII »

You most likely already have another single point of failure: the email account that you use for "forgot your password" resets. So, I make that the only point of failure by choosing long, secure passwords and not really trying to remember them, resetting the password every time I need to log in to a rarely used account

Re: Ask HN: Does anyone use an alternative to a password manager?

#76

Post by n4r9 »

clort wrote: post #43
reacweb wrote: post #7

I have a file on the local drive of my office computer and a sheet of paper near my home computer (used by me and my wife). When the sheet of paper is full of handwriting, I bring it to office to synchronize both list.. When my house has been robbed last year they have not found the sheet, but if they had, I could have changed all passwords very quickly. In case of fire, the backup is safe in a remote location. It is…

> I think my list of password would not be the main target of an attack. I used to have a little notebook with everything, tucked 'securely' out of the way. I mean, even in a robbery somebody isn't going to rifle through some junk on a shelf right? I came to think though, that in that situation of course a list of passwords is not the target but if the robber has a small amount of technical knowledge (getting more li…

Keepass-plus-syncthing is my weapon of choice also. Using your phone as one of the devices gets around the whole "bring your sheet of paper to work day".

It would be great if someone added this feature into Keepass so that you didn't have to use an additional tool. Each instance of a database would have its own key and set of linked databases. When you open the database it would sync with every one of its linked databases that is also open. This would (hopefully?) get around the problem of adding new passwords to different databases before syncing. I expect one issue might be that people tend to only log into one instance of their database at a time.

Re: Ask HN: Does anyone use an alternative to a password manager?

#77

Post by bribroder »

Outpox wrote: post #32
paule89 wrote: post #17

I am at the moment also trying out password managers and searching for the best one. Lastpass so far has the best features, great password generation. But on Android it lacks a good and decent integration in finding and selecting the correct password for an app. Seriously bad. 1Password is better in this regard, but you can not swipe the 1password "click here to fill out with 1password" away. So also definetly a deal…

I would suggest Bitward[0]. I used Lastpass (premium) for 3 years but when I switched from Chrome to Firefox Nightly a few months ago I learnt that Lastpass didn't have a web-extension for Firefox (it was the old extension which wasn't compatible anymore). I waited a few months hoping they would release it quickly since there's very little difference between a Chrome and Firefox extension but nope. So I canceled my p…

There is a lastpass extension, including the binary version, for firefox:

LastPass Firefox Toolbar Version: 4.2.3 Built: Mon Dec 04 2017 13:51:36 GMT-0500 (EST)

Binary Component: true (Native Messaging version 4.1.44, built Nov 16 2017 23:33:27)

Is it broken upstream in the nightly build, but not in the stable build?

Re: Ask HN: Does anyone use an alternative to a password manager?

#78

Post by Waterluvian »

I use an algorithm. In short:

1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to.

Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email.

It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution that is much better than using the same password for everything, but naturally is worse than using significantly different passwords.

I've used this for a few years to great success. The one issue I have is I sometimes have to try multiple times when one account is many types of services.

Re: Ask HN: Does anyone use an alternative to a password manager?

#79

Post by beojan »

nullterminator wrote: post #45

I use Linux, Windows, and Android. I decided on Pass [1] and it's been working really well for me. I have a dedicated PGP key that encrypts all my passwords, and they're stored on my own git server. On Linux I use the pass command, on Windows I use QtPass [2], and on Android I use Password Store [3] and OpenKeychain [4] (for the PGP key). My "master password" is the password for the PGP key, and I type it each time I…

Why use a PGP key instead of symmetric encryption (either with a random key encrypted with your master password, or a key derived from your master password)?

Re: Ask HN: Does anyone use an alternative to a password manager?

#80

Post by larsen161-2 »

Remember that your email is part of your password. When sites are compromised your email is never encrypted and when you use the same email across every site a hacker now has part one of your login. For those unlucky to use the same password across many sites, once the password is obtained it can now be used at other sites. If you have a unique email (login) to every site then using the same password becomes less of an issue as the hacker now only knows 1 part of the authentication values. Still best to use different passwords though.
Post reply on HN