Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

201–210 of 320 posts

Re: Ask HN: What is your password management solution?

#201

Post by dheera »

G3E9 wrote: post #165
dheera wrote: post #157

Earlier quoted context omitted.

No, I'm using 'n' to deal with websites that periodically require you to change password and enforce that you use a new password I suppose I could also do it as master_password + '/' + domain + str(n) or something like that.

Ahh, ok then how about using the DateTime at runtime? That would then save you from having to keep "n" stored elsewhere for future uses. Edit: nevermind, this would prevent you from retrieving the password - I had in mind a password generator, sorry.

By the way it's generally not a good idea to use dates in password generation or for random seeds. An attacker who has any information about the approximate time you generated the password (e.g. minutes before registering for a site) would be able to iterate over those several thousand seconds.

For consumer use cases, you should use sources of noise for this, such as microphone noise, mouse movements, fluctuating voltages, etc. If you wanted to be super-secure you would use a quantum random number generator, which is truly random, but unnecessary for the threat models of most consumer uses. Just use anything but date/time. The random number generators of most modern languages and operating systems already have such measures in place.

Re: Ask HN: What is your password management solution?

#203

Post by chippy »

jasonincanada wrote: post #149

I rolled my own solution a couple years ago: https://gridpass.io/ Your master password is remembered visually , instead of as an arbitrary string. My contention is that you're less likely to forget specific spots on distinct images than an arbitrary sequence of characters. The method has worked perfectly for me since I began using it, but only one other person I know uses it, and it has NOT been audited or scrutinize…

I like this idea. Giving it a go, I found generating the passwords time consuming - as in sometimes I would be okay to get a simple 2 image throwaway password without having to go throuugh all 6 images. However I suspect that my impatience was just curiosity in wanting to find out how it worked, and what I would see whan I finished :-)

I also didn't feel much attachment to the image - which could be addressed and has got me more interested about. Memory palaces. Genius loci - ancient way of remembering things using space, places. This works in a similar way, images exist on 2D space - the genius loci work best when the mental image is something you know well, that you remember well.

Thanks for sparking some ideas in my head!

Re: Ask HN: What is your password management solution?

#206

Post by wodenokoto »

dheera wrote: post #173
rosser wrote: post #148

Earlier quoted context omitted.

How does incrementing a counter address some sites requiring special characters while others reject them?

The counter only addresses requirements to change password periodically. The special character requirement is addressed by tacking on 'Aa$1' to all passwords (they asked for it; it's what I tacked to all the (good) passwords I memorized even before I had this method).

All your passwords have special characters. Some places do not accept special characters in passwords.

This is what your scheme doesn't address.

Re: Ask HN: What is your password management solution?

#209

Post by scott00 »

prophesi wrote: post #107
weinzierl wrote: post #73

Earlier quoted context omitted.

The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...

"Pretty much anything that can be remembered can be cracked." Randomly choose 6 words from a 10k English dictionary and you're set. Hell, make it 12 words. Still insanely easier to remember than a 12 character alphanumeric/symbol password, and much more difficult to crack.

I'm partial to using a very broad dictionary: http://app.aspell.net/create?max_size=35&spelling=US&max_var....

It has 50,105 words. Gets you an extra 2.3 bits per word.

Re: Ask HN: What is your password management solution?

#210

Post by wodenokoto »

I use a system where I mix a counter, a master password and website URL.

I don't hash it via a software algorithm, it is a system simple enough to do in my head.

I basically only have to keep track of the counter for the few websites that have forced me to change password.

The counter exist both as a number and spelled out, ensuring that changes in password differs enough for websites that require new passwords to not be similar to old passwords.

It is as secure as any 8-10 character password, except if a person is targeting me, and manages to get 2 or more passwords, there is a chance that they'll notice the system.

But if I am targeted by someone who can crack multiple of my online passwords, then I have pretty much given up hope for my safety.

Post reply on HN