Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Algorithms

penguindreams.org

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Password Algorithms

#11

Post by metalliqaz »

gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device?

Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

Re: Password Algorithms

#12

Post by YPCrumble »

jksmith wrote: post #8
zeveb wrote: post #7

Earlier quoted context omitted.

> I use a password manager and generate 30-ish character long passwords Do note that you don't need anything more than 22 random mixed-case letters & digits: 26 lower-case letters plus 26 upper-case letters plus ten digits is 62, and 62²² ≈ 2¹²⁸. Completely agree re. the ineptitude of the developers of sites that try to limit one to less than that.

diceware.com

This says that "alger klm curry blond puck" is easy to remember. I would forget that very quickly.

Re: Password Algorithms

#13

Post by xorfish »

TheArcane wrote: post #5
zeveb wrote: post #4

Yes, a password algorithm is better than using the same password over and over, but a password manager is better still, and while initially less convenient it's eventually more convenient (since with a password algorithm one must rotate all passwords on the terms of the shortest-lived key, and one must use the intersection of all password rules — which may not even be possible). For that reason, I think that a secure…

> not something like LastPass Why? Friends have found LastPass to be pretty reliable and user friendly so far.

LastPass is not open source.

Re: Password Algorithms

#14

Post by Ajedi32 »

metalliqaz wrote: post #11
gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

You have a phone, don't you? Just look up your passwords on there.

You can even use something like InputStick to auto-type the password into the other computer if you'd rather not do it manually.

Re: Password Algorithms

#15

Post by lucideer »

roryisok wrote: post #6

The author recommends using a password algorithm that you can mentally process and then storing the results in a password manager. If you're going to store them why not let the password manager generate the pass for you?

My guess is that the intent is that the passwords would be recoverable by you without the aid of a password manager, but that the relative convenience of a password manager still adds benefits (e.g. behaviourally: guiding you away from any potential tendency to opt for "simpler" passwords out of laziness)

Re: Password Algorithms

#16

Post by gambiting »

fredley wrote: post #9
gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif

Heh, our HR system had a following requirement:

- password must be between 7 and 8 characters long

- has to include one number

- has to include one of the following: $#!*, no other special characters are allowed

It was so horrendously bad it's not even funny.

Re: Password Algorithms

#17

Post by Ajedi32 »

YPCrumble wrote: post #12
jksmith wrote: post #8

Earlier quoted context omitted.

diceware.com

This says that "alger klm curry blond puck" is easy to remember. I would forget that very quickly.

Yeah, the default word list is pretty terrible. Try one of the ones from the EFF: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

Re: Password Algorithms

#18

Post by drinchev »

metalliqaz wrote: post #11
gregmac wrote: post #2

> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…

How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.

Working on computers that aren't yours and remaining secure is quite challenging.

I would recommend you to use any password, but rotate the credentials every time you enter them in one of these.

Re: Password Algorithms

#19

Post by e0m »

I used to have a password algorithm then switched to 1Password and never looked back.

My problem of 4 years of algorithm use was that it would slowly change over time. I began to add mechanisms to predictably rotate the passwords. I began to add mechanisms that dealt with arcane dumb password requirements. Encountering a login from 3 years ago usually had me trying 3 different variants before getting it.

Furthermore, my algorithm still produces passwords that have considerably less entropy than a password generator will do for you.

The other advantage of password managers are for those damn security questions. I now routinely use 4-word diceware generated password as my security question answers and can store those in 1Password as well. The number of websites that let you bypass login with just a security question is mind blowing.

Post reply on HN