I use passpack.com.
Ask HN: What is your password management solution?
71–80 of 320 posts
Re: Ask HN: What is your password management solution?
#72This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…
Disadvantages: - You have to keep track of n for every site. - If the master password is compromised, you have to change each password manually. - Not well-integrated with browsers. - Far less convenience on a phone.
I use https://pwdhash.com with _n_ suffixed to the master password.
- If last few recent n's don't work, I just reset the password to the most recent n.
- There are browser extensions
- There are apps, and my web UI (https://ph.leftium.com) works OK (and a bookmarklet adds more convenience)
Re: Ask HN: What is your password management solution?
#73This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…
The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1]
[1] https://boingboing.net/2014/02/25/choosing-a-secure-password...
Re: Ask HN: What is your password management solution?
#74I use https://pwdhash.com algorithmic password generator. It is the sweet spot of more security without too much added frustration. Usually I use the Chrome extension, but when that fails I built a more user friendly web interface: https://ph.leftium.com To avoid having to change all my passwords at once when one password must be changed, I suffix my master password with a sequential suffix. In the worst case, the la…
Note that the algorithm used by pwdhash is very weak. It uses just one round of 1 round of HMAC-MD5. Not even a slow hash function.
See https://github.com/dannysu/hash0 for comparison of other similar sites that all have the same flaw and the reason I coded hash0 (no longer maintained though).
Re: Ask HN: What is your password management solution?
#75I use Universal Password Manager (UPM). It runs everywhere, syncs to dropbox (or wherever), pretty fast start time even though it's java. Github link: https://github.com/adrian/upm-swing
Re: Ask HN: What is your password management solution?
#76I use keeweb as a desktop app, and I save the file locally, backing up to gdrive and cold storage hard drive weekly.
My laptop is my primary device so I'm not too concerned with logging into accounts on mobile, but if I really needed to get my passwords without my laptop, I could get use the keeweb web app with my gdrive backup.
Re: Ask HN: What is your password management solution?
#77Google passwords. I trust their engineering, it's free, passwords are accessible as long as I have a browser and it comes with Chrome. Negatives: I can't do backups, easily migrate to another supplier and it won't work automatically with other browsers. And it's Google (feels privacy invasive)
This isn't a really great solution, in my opinion. Anyone with access to your google account, or anyone with physical access to any of your synced devices could lift your passwords easily.
Re: Ask HN: What is your password management solution?
#78This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…
The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...
Maybe you have something that calculates what is strong enough? Is there some online calculator?
Re: Ask HN: What is your password management solution?
#79I just use lines of poetry for my passwords. They're long enough, complex enough, but extremely easy for humans to memorize.
[deleted]
Re: Ask HN: What is your password management solution?
#80This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…
Disadvantages: - You have to keep track of n for every site. - If the master password is compromised, you have to change each password manually. - Not well-integrated with browsers. - Far less convenience on a phone.
> - You have to keep track of n for every site.
I consider this far better than having to keep a password manager's database. n = 0 for the vast majority of sites without sensitive personal data. For the small handful that need to change, I usually sync them all to the same value of n about once or twice a year.
> - Not well-integrated with browsers.
I use Chrome's password-saving feature for websites that don't store sensitive personal data. For websites that I consider sensitive, I actually like that it isn't integrated with the browser.
> - Far less convenience on a phone.
This is true. If my laptop can act as a bluetooth keyboard to my phone it might make life easier.