Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 320 posts

Re: Ask HN: What is your password management solution?

#281

Post by ac2u »

bastijn wrote: post #232
tptacek wrote: post #217

Earlier quoted context omitted.

1Password is the only commercial password manager I recommend, but I'll go further than that when it comes to LastPass and say: I really think you should avoid LastPass, and, if you're using it, migrate to something else. I'm not going to go into details, sorry.

Why do the trouble of replying but fail to explain your reasons? That's wasting your own time mostly. I would recommend 1password over lastpass as well. First reason being the security issues of lastpass chrome extension. Though claimed it is fixed now they have claimed before on other issues only to be proven wrong after. I simply don't trust them anymore with my data. But even more I would choose 1password over its…

I suspect the reluctance to offer more than a brief recommendation isn't a lack of confidence in the argument, but rather a sensible level of restraint for someone who is in the security industry.

Re: Ask HN: What is your password management solution?

#282

Post by shocks »

dheera wrote: post #168
dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

By the way, for those wondering about convenience, this will wait 3 seconds (during which you switch to your web browser and click the password field) and then it will "type" the password. (You do NOT want to cut-and-paste your password from a terminal as the clipboard can be read by anything.) # requires: sudo apt-get install xautomation for 'xte' import time from subprocess import Popen, PIPE macro = "" for char in…

I cleaned it up a bit and added the missing keys: https://github.com/wridgers/pwtools/blob/master/bin/pwtype

Re: Ask HN: What is your password management solution?

#283

Post by Bromskloss »

prophesi wrote: post #107
weinzierl wrote: post #73

Earlier quoted context omitted.

The problem with this solution is that it is only as strong as your master password. Because you suggest to 'never write or store [it] anywhere' it can't be strong enough. To say it in Bruce Schneier's words: "Pretty much anything that can be remembered can be cracked."[1] [1] https://boingboing.net/2014/02/25/choosing-a-secure-password...

"Pretty much anything that can be remembered can be cracked." Randomly choose 6 words from a 10k English dictionary and you're set. Hell, make it 12 words. Still insanely easier to remember than a 12 character alphanumeric/symbol password, and much more difficult to crack.

I realised after choosing random words that gets annoyingly long to type. In that regard, random characters are better.

Re: Ask HN: What is your password management solution?

#284

Post by JoshuaRLi »

nikital wrote: post #65
raamdev wrote: post #31

Earlier quoted context omitted.

+1 for `pass`. I wrote a handy Bash script [1] that lets me easily search my passwords without having an exact match (e.g., `fpass fin cap one` quickly finds my password info for "Financial/CapitalOne.gpg"). It makes pulling up passwords so much easier as I only need to remember fragments of how I stored it instead of trying to remember exact folders and names using auto-complete to find the password. I also use iTer…

> The only downside is no access from my phone. On Android, I use Password Store to sync my `pass` directory and use it from the phone. It a very high quality app, I had no issues after years of usage. https://github.com/zeapo/Android-Password-Store

Keepass user here wanting to switch over to pass, this is exactly the missing piece of the puzzle I needed - thank you!

Re: Ask HN: What is your password management solution?

#285

Post by kuzimoto »

dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

I use the standard keepass 2 client on my windoes machines, and keepass2android on my phone. Clients only access the file via ssh to my server at home so it doesn't require storing the database on other machines.

Re: Ask HN: What is your password management solution?

#286

Post by kuzimoto »

dannysu wrote: post #23

I use KeePassXC [1], which is open-source, and I sync it across my iPhone, Windows laptop, and Linux desktop via Tresorit [2] (like Dropbox but end-to-end encrypted). It's secured with a password that I know, and a keyfile that I have. I don't sync the keyfile and always manually transfer to new computers. I also use Arq [3] to automatically backup to S3 every hour, and I also do manual backup to my external backup d…

I use the standard keepass 2 client on my windoes machines, and keepass2android on my phone. Clients only access the file via ssh to my server at home so it doesn't require storing the database on other machines.

Re: Ask HN: What is your password management solution?

#288

Post by m1keil »

dewey wrote: post #12

1Password & gopass ( https://www.justwatch.com/gopass/ , it's "pass" compatible if you are using that already). I don't really mind the subscription service as it works fine across all platforms I use.

Do you sync 1password and gopass? or one for home and other for work?

I love 1Password but the lack of linux support is irritating. (I know about the web client)

Re: Ask HN: What is your password management solution?

#289

Post by leemck »

I have been managing passwords for more than 12 years with an encrypted vi file. Inside the file, every login uses a unique password. I generate unique passwords in batches of 100 or so using a script that I list below.

This scheme has the obvious single point of entry weakness and a further keystroke logger vulnerability. I have never had any of the 360+ accounts and logins compromised.

It is very important to not use the browser for secure activity if one has been browsing Internet junk recently. I have no doubt that all kinds of keystroke logging scripts do get started. I occasionally run rkhunter and top looking for intrusions and compromises.

Script for making big batches of passwords:

      File of passwords. First 99 are lettes usable for names, next 100 is pasword strings. 1-6-2008

      Here is the command line:

      (/usr/bin/apg -a 1 -n 99 -m 11 -x 13 -M CL; /usr/bin/apg -a 1 -n 100 -m 17 -x 23 -M NCL ) | cat -n

Re: Ask HN: What is your password management solution?

#290

Post by antisthenes »

mhw wrote: post #196

PasswordSafe - https://pwsafe.org I use the open source version on Linux and Windows, and https://pwsafe.info on Mac and iOS, all syncing through Dropbox.

Was expecting more mentions of this wonderful utility. It seems to work well in conjunction with a sync service (use Gdrive personally).
Post reply on HN