Ask HN: What is your password management solution?

Post by leipert » Sat, Jul 15, 2017, 3:35 PM UTC

sgt101 wrote: post #34

tentaTherapist wrote: post #22

Earlier quoted context omitted.

Congratulations for having the patience to write out long strings of characters on paper and type them out repeatedly, but that doesn't sound very safe.

You can make it safe by using a secret key in conjunction with the keys. For example; all passwords as written but the third character must be # instead of what's written. This renders the book useless if stolen or copied. If you keep the book in a locked draw and use some tell tails to ensure that you will know if it's been opened you have a strong chance of being able to know if you have been physically compromised…

Post by roryisok » Sat, Jul 15, 2017, 3:37 PM UTC

dannysu wrote: post #38

rhlala wrote: post #37

Earlier quoted context omitted.

Why not use dropbox? It is only used for sync databases, not access them, I always though if someone found my keypass database encrypted it would be useless.

Paranoia Yeah, the KeePass database is encrypted and I secure it with both password and keyfile, but I still want something that won't leave my database "out there" available for bruteforce attempts or other attempts at it.

Post by dheera » Sat, Jul 15, 2017, 3:37 PM UTC

dagenix wrote: post #81

dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

Disadvantage: If any website you use has it's password database leaked, an attacker can then do an offline brute force attack to recover your master password. Then, the attacker can then generate your password to every other site you use, such as banks and email, just by trying a couple values of n.

Post by Exuma » Sat, Jul 15, 2017, 3:42 PM UTC

dheera wrote: post #83

weinzierl wrote: post #73

Earlier quoted context omitted.

The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...

I memorized 1024 digits of pi in high school. I can deal with a strong password. Keep in mind that most password managers also encrypt your password database with your master password, so my solution isn't any worse than those. Memorizing a even a 16-character (upper/lower + symbols) random string as your master password would be 16*6 = 96 bits of entropy which is more than enough. Dealing with memorizing ONE good 16…

Post by weinzierl » Sat, Jul 15, 2017, 3:43 PM UTC

dheera wrote: post #83

weinzierl wrote: post #73

Earlier quoted context omitted.

The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...

I memorized 1024 digits of pi in high school. I can deal with a strong password. Keep in mind that most password managers also encrypt your password database with your master password, so my solution isn't any worse than those. Memorizing a even a 16-character (upper/lower + symbols) random string as your master password would be 16*6 = 96 bits of entropy which is more than enough. Dealing with memorizing ONE good 16…