Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is your password management solution?

news.ycombinator.com

Post reply on HN
Print view View original

301–310 of 320 posts

Re: Ask HN: What is your password management solution?

#301

Post by dheera »

SAI_Peregrinus wrote: post #272
prophesi wrote: post #107

Earlier quoted context omitted.

"Pretty much anything that can be remembered can be cracked." Randomly choose 6 words from a 10k English dictionary and you're set. Hell, make it 12 words. Still insanely easier to remember than a 12 character alphanumeric/symbol password, and much more difficult to crack.

Better yet, use the EFF's Diceware list. It's easy to pick randomly from the list (just roll some dice) and the resulting passphrase won't have some of the issues a dictonary chosen one would have, like compound words causing entropy reductions. (EG if fire, truck, and firetruck are included in the dictionary as 3 separate words and you happen to get fire and truck in sequence as part of your passphrase the entropy o…

> if fire, truck, and firetruck are included in the dictionary as 3 separate words and you happen to get fire and truck in sequence as part of your passphrase the entropy of those two words is equivalent to the entropy of a single word

Not exactly true if they are separate words. In a word-based password scheme, you are treating entire words, not characters, as units. The chance of fire, truck, and firetruck appearing in one password in that sequence, given a 10K word dictionary, is 1/(10K^3). The miniscule possibility of this speaks to the fact that there actually is a large entropy.

Re: Ask HN: What is your password management solution?

#302

Post by todd8 »

dagenix wrote: post #81
dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

Disadvantage: If any website you use has it's password database leaked, an attacker can then do an offline brute force attack to recover your master password. Then, the attacker can then generate your password to every other site you use, such as banks and email, just by trying a couple values of n.

I think the idea is that the master password can be memorable enough by picking say 6 random diceware words and still strong enough to resist all (pre-quantum) brute-force attacks for a long time.

The arithmetic then looks like this:

(7776 ^ 6) = 221073919720733357899776, because there are 7776 words in the diceware list.

(7776 ^ 6)/(10^12) = 221073919720 seconds to try all such password if the imagined hardware accelerated hash cracker can do one trillion hashes per second. In years this is:

(7776 ^ 6)/(10^12)/(365 * 24 * 60 * 60) = 7010 years.

So on average, it will take about 35 centuries to brute force the password when using hardware that can try one trillion guesses per second.

Re: Ask HN: What is your password management solution?

#303

Post by 6ak74rfy »

ktta wrote: post #233
6ak74rfy wrote: post #123

Earlier quoted context omitted.

I don't understand the hate against Lastpass. Why would I trade it's awfully simple features (autofill on Android, automatically save/update passwords from website forms in browser, cheap etc.) for something like Keepass, even if the latter is purportedly a bit more secure? Some people also say that Lastpass's UI isn't great, but who cares about a password manager's UI as long as it does the job?

>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2] 2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3] 3. Last year a so…

Oh my. Thanks for taking the time to list these down. Will work right away to get off Lastpass. No, seriously!

Re: Ask HN: What is your password management solution?

#304

Post by stirner »

markwhiting wrote: post #278
khn1 wrote: post #163

Earlier quoted context omitted.

iCloud Keychain works great for me. Although, if I could change one thing, it would be to add a dedicated iOS app, instead of having to go to Settings > Safari > Passwords.

Its somewhat easier in iOS 11, there's a more dedicated area in settings. Also, in iOS 11, it provides usernames and passwords within apps, which is super convenient.

What do you mean by a "more dedicated area"? I don't have a spare device to test the beta on.

Re: Ask HN: What is your password management solution?

#306

Post by ktta »

6ak74rfy wrote: post #303
ktta wrote: post #233

Earlier quoted context omitted.

>purportedly a bit more secure? The worst bugs in LastPass are: 1. Four months ago a bug was discovered by project zero[1] about how all of your passwords can be stolen just by making a user visit a webpage. Moreover, any code can be executed remotely, compromising your entire computer. Discussion[2] 2. Later on the day vulnerability (1) was published, another was found. Project zero bug report. [3] 3. Last year a so…

Oh my. Thanks for taking the time to list these down. Will work right away to get off Lastpass. No, seriously!

What ever password manager you move to, chose something that will stay far away from your browser. And don't use anything that autofills your passwords. This includes KeePassHTTP.

Re: Ask HN: What is your password management solution?

#310

Post by skinnymuch »

maxxxxx wrote: post #265
skinnymuch wrote: post #253

Earlier quoted context omitted.

Do you know people who run it? Doesn't seem very popular. The prices are pretty expensive with their in my opinion bad limitations on their plans. Limiting by number of password seems lame. Their allowance of a lot of shared users might be good but I'm not completely sure what that means. Not sure why anyone would use them over Lastpass or 1Password.

I chose them a long time ago for reasons I don't remember. It seems to be working well so I don't see a reason for changing. I would probably to something open source now.

Yep same here for sticking with 1PW. Anything goes too bad with it, I'll probably go open source.
Post reply on HN