Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 320 posts

Re: Ask HN: What is your password management solution?

#91

Post by rocqua »

dheera wrote: post #83
weinzierl wrote: post #73

Earlier quoted context omitted.

The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...

I memorized 1024 digits of pi in high school. I can deal with a strong password. Keep in mind that most password managers also encrypt your password database with your master password, so my solution isn't any worse than those. Memorizing a even a 16-character (upper/lower + symbols) random string as your master password would be 16*6 = 96 bits of entropy which is more than enough. Dealing with memorizing ONE good 16…

The standard password manager is slightly better because the password database works like a 2nd factor.

Also, a character has at most 8 bits of entropy, not 64. If you use base 64 its only 6 bits of entropy. 16 x 6 = 96 bits is still more than enough though.

A downside if everyone used this scheme would be parallelized attacks on reversing the hash for the key. If you find a key that, with this scheme, creates a password for your service, you found the corresponding secret key. This then compromises all of that users passwords.

Re: Ask HN: What is your password management solution?

#92

Post by ryanSrich »

Luc wrote: post #68
ameister14 wrote: post #50

I just use lines of poetry for my passwords. They're long enough, complex enough, but extremely easy for humans to memorize.

If it were me I'd add a bit of salt (some random string) to those...

This is what I do. Music lyrics with characters mixed in. I have the alternates memorized so it's fairly easy to remember. Ex: 5, S, and $ are all interchangeable.

Re: Ask HN: What is your password management solution?

#93

Post by [deleted] »

dheera wrote: post #83
weinzierl wrote: post #73

Earlier quoted context omitted.

The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...

I memorized 1024 digits of pi in high school. I can deal with a strong password. Keep in mind that most password managers also encrypt your password database with your master password, so my solution isn't any worse than those. Memorizing a even a 16-character (upper/lower + symbols) random string as your master password would be 16*6 = 96 bits of entropy which is more than enough. Dealing with memorizing ONE good 16…

[deleted]

Re: Ask HN: What is your password management solution?

#94

Post by Confusion »

dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

Same, but using Keepassdroid + DropSync use it on, and sync it to, my Android phone.

Crashplan is my backup tool of choice and also backs up the Dropbox, just in case...

Re: Ask HN: What is your password management solution?

#95

Post by stephengillie »

dannysu wrote: post #38
rhlala wrote: post #37

Earlier quoted context omitted.

Why not use dropbox? It is only used for sync databases, not access them, I always though if someone found my keypass database encrypted it would be useless.

Paranoia Yeah, the KeePass database is encrypted and I secure it with both password and keyfile, but I still want something that won't leave my database "out there" available for bruteforce attempts or other attempts at it.

What is the cause for your paranoia about keeping your keyfile in your Dropbox? I have used and advocated this model for years with no ill effects.

My Dropbox is secured by MFA, with the Dropbox password itself being a random password within the KeePass keyfile. I store the whole Keepass program for Windows inside the same Dropbox account, feel free to indicate that as a security gap. On mobile I use the KeePass2Android app.

Re: Ask HN: What is your password management solution?

#96

Post by afshin »

dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

One problem I had when using a similar technique is how to change passwords. Some services require regular password changes, security breaches require it, etc.

So I needed some additional piece of information, namely how many times I've had to change passwords, so a new function argument.

Eventually I gave up and started using a password manager.

Re: Ask HN: What is your password management solution?

#97

Post by rocqua »

ameister14 wrote: post #50

I just use lines of poetry for my passwords. They're long enough, complex enough, but extremely easy for humans to memorize.

The entropy in that is actually quite low, especially if you have even just a slight bias towards popular poems. Given this info I think it'd be quite easy for a dedicated person to reverse a password hash of yours.

Re: Ask HN: What is your password management solution?

#100

Post by dagenix »

dheera wrote: post #86
dagenix wrote: post #81

Earlier quoted context omitted.

Disadvantage: If any website you use has it's password database leaked, an attacker can then do an offline brute force attack to recover your master password. Then, the attacker can then generate your password to every other site you use, such as banks and email, just by trying a couple values of n.

That's the point of using PBKDF-HMAC-SHA256. As long as your master password is strong it's not going to be brute forceable for the forseeable future.

My point is that this is dangerous. The security of this method is equal to the strength of you master password + the least secure website you use. If that website has a password breach, the only thing standing between an attacker and a compromise of every website you use is the strength of you master key. (And GPUs are pretty good at brute forcing PBKDF2 - so it has to be really strong.)

This is unlike a stateful password manager. There the security of the system is related to the strength of your password + the strength of the security of the place you store your password db. If you pick a place that is serious about security, your almost certainly better off. Critically, a compromise of some random forum you signed up for doesn't impact the security of your bank account in any way.

Post reply on HN