Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#81

Post by extra88 »

paule89 wrote: post #17

I am at the moment also trying out password managers and searching for the best one. Lastpass so far has the best features, great password generation. But on Android it lacks a good and decent integration in finding and selecting the correct password for an app. Seriously bad. 1Password is better in this regard, but you can not swipe the 1password "click here to fill out with 1password" away. So also definetly a deal…

> a website just shows your username already and you have to fill out the password and can't use hotkeys. (I am looking at you google)

I don't know about mobile (especially Android), but at least on Google's authentication page, even though it only visually presents the username field, the password field is already there and is filled out by 1Password.

Re: Ask HN: Does anyone use an alternative to a password manager?

#82

Post by beojan »

midgetjones wrote: post #75

I have one of these. I personally never use it due to the inconvenience, but it might work for you. https://www.qwertycards.com/

The space bar code and "secret word" portion together are the same across all sites. If your password is compromised on two or three services, the attacker has this constant portion, and the remainder of your password is a simple substitution cipher encoding the service's name.

Re: Ask HN: Does anyone use an alternative to a password manager?

#83

Post by saflkdeating »

Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

I do basically the same thing, and have for years also. My only frustration with this is that with some sites, due to arcane password restrictions, the algorithm either isn't implementable, or is only implementable in such a way I won't remember. So 90% of the time the strategy works great, and in 10% of the time it fails due to idiosyncracies of the sites involved.

I hate the stupid restrictions sites place on passwords. There should be almost no restrictions.

Re: Ask HN: Does anyone use an alternative to a password manager?

#84

Post by ProblemFactory »

Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

The Algorithm is a great solution - breaking the pattern would require password leaks from 3-4 different sites, and a human to spend time puzzling over it. For automated bots the passwords look unique.

What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you are up to?

Re: Ask HN: Does anyone use an alternative to a password manager?

#85

Post by NoGravitas »

I'm a bit surprised at all of the people suggesting "remember one password, and mutate it with an algorithm based on the website name". That means that if you have to invalidate one password for any reason, you have to change all of them. On every service that you use. Do people really do this?

Re: Ask HN: Does anyone use an alternative to a password manager?

#87

Post by oneweekwonder »

jlebrech wrote: post #40

dashlane is interesting as i has a one button password regeneration that logs into sites uses the change password functionality for you.

> change password functionality for you

Lastpass has the same functionality. This is actually a feature open source tools like keepass and so on needs. That and easy cloud/mobile integration.

Re: Ask HN: Does anyone use an alternative to a password manager?

#88

Post by dpc94 »

saflkdeating wrote: post #83
Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

I do basically the same thing, and have for years also. My only frustration with this is that with some sites, due to arcane password restrictions, the algorithm either isn't implementable, or is only implementable in such a way I won't remember. So 90% of the time the strategy works great, and in 10% of the time it fails due to idiosyncracies of the sites involved. I hate the stupid restrictions sites place on passw…

I have the same issue. My full password is over 20 characters, but some websites restrict to less than that or don't accept the special character that I use.

Re: Ask HN: Does anyone use an alternative to a password manager?

#89

Post by oneweekwonder »

UntitledNo4 wrote: post #53

My alternative is believing that not all websites you log into pose the same risk to you and accepting some risk. This means I divide websites that require login into two categories: 1. I don't care if somebody gains access to my account 2. I do care if somebody gains access to my account I use the same password for all the websites on the first category. It should be at least 8 characters long, consists of a made up…

I actually ctrl+f for xkcd[0] to see if someone jumped the gun on posting the cartoon.

Something like that for a base password and then for each website mutate it a bit. Other people in the thread described methods they use.

I also use lastpass(paid personal), keepass+chromepass(work). Where I normally save the base password(and added mutations) yearly to change the base; or save the mutated password as I use it more for convenience.

I do not save certain financial and banking related sites.

And recently actually had a bit of a panic attack as I forgot my master password for a hour or so. Realised I need a fail save if I forget it again. Something like telling a close friend or sticky note to the monitor.

Still deciding, any suggestions would be appreciated?

[0]: https://www.xkcd.com/936

Re: Ask HN: Does anyone use an alternative to a password manager?

#90

Post by scoates »

danicgross wrote: post #21

We really need passchange.js: an open source collection of headless JS scripts that can programmatically change your password on a given website. Then you would continuously rotate _all_ your managed passwords as well as your master. Not a panacea, but significantly minimizes the length of a theoretical breach.

I have been working on-and-(mostly-)off on something like this for a while: https://github.com/scoates/celobox

Wish I had more time to spend on it.

Post reply on HN