211–220 of 320 posts
[deleted]
head -c 18 /dev/urandom | base64
Subscription to 1Password is not mandatory. Or at least it was not in the past. Without a subscription, you can create local vaults which can be synced via Dropbox, iCloud or over WiFi within the same subnet (which means over VPN too). Here is some documentation on the Dropbox sync for example: https://support.1password.com/sync-with-dropbox/
I don't use random passwords, I use (mostly) memorable ones. I mount the disk image only when I forget one. It's an aid to help me memorise passwords and keep track of important information (reference numbers etc), not a single point of failure without which I can't get into anything.
This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…
The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...
"green rubber yellowed out inside the 1st horizon"
I make random passwords like that (though usually 6+ words) all the time. I admit I can't remember all of them, but I can remember up to ten or twelve. Which is enough passwords to cover all the important services I use.
The big pain with that is that some services don't allow more than N characters for passwords (looking at you, 20-characters-limit-PayPal), some services don't allow spaces and whatnot, so you have to adapt.
Plus, you should enable 2FA wherever possible. You don't really need a super strong password once you have 2FA, so for those cases you can resort to OP solution of having "master_password + 'whatever' + domain" with master password being one of those ten you can actually remember and not even having to encrypt the whole thing.
`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/
If you're not going to use 1Password, which is still the only commercial password manager I'll recommend, "pass" is probably your best alternative.
I use https://pwdhash.com algorithmic password generator. It is the sweet spot of more security without too much added frustration. Usually I use the Chrome extension, but when that fails I built a more user friendly web interface: https://ph.leftium.com To avoid having to change all my passwords at once when one password must be changed, I suffix my master password with a sequential suffix. In the worst case, the la…
Note that the algorithm used by pwdhash is very weak. It uses just one round of 1 round of HMAC-MD5. Not even a slow hash function. See https://github.com/dannysu/hash0 for comparison of other similar sites that all have the same flaw and the reason I coded hash0 (no longer maintained though).
But to be honest, if a hacker specifically targets you, you will probably be compromised, no matter how strong a hash function you use. (They will probably just use one of the many other attack vectors.)
And there's that joke about two guys running from a bear. "I don't have to outrun the bear; I just have to outrun you"
PwdHash lets me have unique, non-trivial passwords for every site with minimal fuss. There will be probably lots of lower hanging fruit before hackers start targeting PwdHash-generated passwords.
Earlier quoted context omitted.
If you're not going to use 1Password, which is still the only commercial password manager I'll recommend, "pass" is probably your best alternative.
As a LastPass user, any particular reasons why I should avoid them? Is it down to all the security issues they've faced lately?
I'm not going to go into details, sorry.
> I want something that keeps an encrypted file that I can put in dropbox FWIW You can do this with 1Password. Preferences > Sync > Sync with Dropbox
1) Make up a unique password on the spot. 2) Log in and forget it. 3) Reset password. Works every time.
But yeah, it works in most cases.
Earlier quoted context omitted.
Which technique did you use? I made it to around 150 using the memory palace technique from the excellent book Moonwalking with Einstein.
I'm not sure what the various methods are called or what they are -- never really researched it. I just memorized about 10 digits every day over the course of a summer. Every day I practiced typing out the entire thing a few times as well as practiced the most-recent 100-block several more times.