Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#61

Post by blowski »

sixhobbits wrote: post #59
blowski wrote: post #22

Earlier quoted context omitted.

> there is a valid argument that managers are not necessarily the best solution What is that argument?

"Depending on your usecase" - e.g. you use many devices, need your passwords on all of them, and don't trust any of the current password managers to do their job (which is valid due to the many breaches and vulns).

Is the reality that your home-grown solution is genuinely going to be more secure than one of those current password managers? I doubt it.

However, I agree that for some people existing password managers seem either too complicated (KeePass) or expensive (1Password). In that case, I recommend:

1. Generate a password randomly using a 'diceware' type methodology

2. Use a standard prefix in front of all your passwords.

3. Write the password without the prefix in a notebook that you carry everywhere.

It's still not as good as 1Password because the passwords are not encrypted. But it's better than using a predictable algorithm that you have to remember. And of course, it's better than the system this often replaces - using the same 8 character password everywhere.

But I still strongly recommend paying for 1Password. How much do you pay for a padlock for your bike, or a burglar alarm for your house?

Re: Ask HN: Does anyone use an alternative to a password manager?

#63

Post by laci27 »

duncan_bayne wrote: post #19

Yep - a text file, encrypted with ccrypt. Happily, Emacs knows how to open and save ccrypt-ed files.

Why would you use an encrypted file when you have free, open source password managers like Keepass? Every time you login somewhere, you open the file, search for the site, copy the password and paste it in the browser? What do you do when you need a password on your phone? What do you do to clean your memory after the paste operation to reduce the likelyhood of memory trojans reading it?

Re: Ask HN: Does anyone use an alternative to a password manager?

#65

Post by kqr »

natch wrote: post #24

I have a couple scripts, 'add' and 'get', which respectively add or get an entry associated with some keys to a text file. An example line in the text file looks like this: facebook password: [base64:U2FsdGVkX1/T8CoWmfDOoaapE5lGj/fqHE3s8NohnriGajnPrCzWikCneU/u7] Anyone thinking of trying to crack that, well good luck. I removed and twiddled a few characters from it, as if it wasn't hard enough already. Oh but here's…

Why generate symbols that are not permitted anyway? You'd lose nothing by emitting the base16 encoding of the symbol.

Re: Ask HN: Does anyone use an alternative to a password manager?

#66

Post by kqr »

tga wrote: post #60

* descriptive, long passphrases, that I usually have no trouble remembering. e.g. Facebook could be "I talk to my friends". * salt to make stupid password rules happy and to make it somewhat safe to write down passwords. e.g. "mysecretsalt42$". This gets appended to all passwords and doesn't get written down anywhere. * encrypted text file, used rarely when I forget a password. e.g. `vim -x socialmedia.txt`. I find t…

I might adopt this strategy. I really like most aspects of it.

Re: Ask HN: Does anyone use an alternative to a password manager?

#67

Post by sigsergv »

kqr wrote: post #66
tga wrote: post #60

* descriptive, long passphrases, that I usually have no trouble remembering. e.g. Facebook could be "I talk to my friends". * salt to make stupid password rules happy and to make it somewhat safe to write down passwords. e.g. "mysecretsalt42$". This gets appended to all passwords and doesn't get written down anywhere. * encrypted text file, used rarely when I forget a password. e.g. `vim -x socialmedia.txt`. I find t…

I might adopt this strategy. I really like most aspects of it.

If you use service from time to time (or have to login rarely, facebook, for example) then be careful, you'll forget that passphrase.

Re: Ask HN: Does anyone use an alternative to a password manager?

#68

Post by smt88 »

paule89 wrote: post #17

I am at the moment also trying out password managers and searching for the best one. Lastpass so far has the best features, great password generation. But on Android it lacks a good and decent integration in finding and selecting the correct password for an app. Seriously bad. 1Password is better in this regard, but you can not swipe the 1password "click here to fill out with 1password" away. So also definetly a deal…

Chromipass/Foxipass is pretty bad, but Kee for Firefox is amazing.

Re: Ask HN: Does anyone use an alternative to a password manager?

#69

Post by notacoward »

natch wrote: post #24

I have a couple scripts, 'add' and 'get', which respectively add or get an entry associated with some keys to a text file. An example line in the text file looks like this: facebook password: [base64:U2FsdGVkX1/T8CoWmfDOoaapE5lGj/fqHE3s8NohnriGajnPrCzWikCneU/u7] Anyone thinking of trying to crack that, well good luck. I removed and twiddled a few characters from it, as if it wasn't hard enough already. Oh but here's…

I do something similar: passwords created by a script, stored in an encrypted file that's only unwrapped when I'm fetching or storing something. It's important that the entire file is protected, requiring a password every single time. Like you, my biggest gripe is sites with special snowflake "make it hard to remember but keep it low entropy" password policies that preclude the original generated password. IMO we as a community need to start shunning such sites the same way we do for rogue SSL/TLS cert providers. As long as they exist, it's harder for even security-aware sites to move forward.

Re: Ask HN: Does anyone use an alternative to a password manager?

#70

Post by smt88 »

INTPenis wrote: post #29

You're talking about mitigating the risk of break-in by using an alternative to a password manager. I'd rather propse to use a self-hosted password manager on a VPS or in a cloud service. As long as that password manager is hosted securely, VPS for example, and uses your login password to help decrypt the stored passwords. Perhaps some HMAC required too. Anyone know if this exists in the open source world?

KeePass is FOSS, and you can keep your database local or host it wherever you want (your server, Dropbox, Spideroak, etc.)
Post reply on HN