Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#91

Post by sixhobbits »

blowski wrote: post #61
sixhobbits wrote: post #59

Earlier quoted context omitted.

"Depending on your usecase" - e.g. you use many devices, need your passwords on all of them, and don't trust any of the current password managers to do their job (which is valid due to the many breaches and vulns).

Is the reality that your home-grown solution is genuinely going to be more secure than one of those current password managers? I doubt it. However, I agree that for some people existing password managers seem either too complicated (KeePass) or expensive (1Password). In that case, I recommend: 1. Generate a password randomly using a 'diceware' type methodology 2. Use a standard prefix in front of all your passwords.…

I never claimed it was more secure than a password manager. Just 'surprisingly' secure. You get something easy to remember with a lot of entropy that's difficult even for someone targeting you to exploit and which mitigates against the more common attack of cracking passwords en-masse from a leak and retrying them.

Yes, it has its own attack vectors, but they don't include things like ads stealing your info from your password manager [0] and apps stealing your passwords from your clipboard [1], both of which are legitimate reasons why you might want an alternative to a password manager.

"home-grown solution" has very negative connotations in infosec and rightfully so. I don't like seeing it in these kind of contexts as it blurs an important distinction between "Don't write your own random number generator if you're creating an app like Signal" (don't do it) vs "Find a solution to deal something as shitty as passwords in a way that works for you" (do it).

Your recommended method might also suit some people better (e.g. people who already carry a notebook around everywhere and guard it carefully).

There are no silver bullets out there. Work out what your needs are and then find a reasonable solution. It might be a password manager. It might not be.

[0] https://www.theverge.com/2017/12/30/16829804/browser-passwor...

[1] https://arstechnica.com/information-technology/2014/11/using...

Re: Ask HN: Does anyone use an alternative to a password manager?

#92

Post by drdaeman »

aaraujo wrote: post #58
TheHCA wrote: post #42

Earlier quoted context omitted.

This seems like one of the simpler solutions on here, what's your process of dealing with sites that require special characters etc?

I add a special character at the end when it's needed

This works, but doesn't scale.

The problem is, the login form doesn't remind that a) a special character was required and b) what characters that particular site thinks are "special".

Re: Ask HN: Does anyone use an alternative to a password manager?

#94

Post by tboyd47 »

I am working towards a two-tiered system. First tier is kept on a physical PasswordCard and muscle memory, and cycled annually. This is for the sensitive passwords. Second tier is handled entirely with a password manager. The password manager generates, stores, and fills them in for me. These are not sensitive and cycled/recycled as needed. I still have this nebulous "third tier" of leftover passwords that haven't migrated on the new system, where I basically use variations of the same two semi-secure passwords. I hope to eventually get rid of this tier.

Re: Ask HN: Does anyone use an alternative to a password manager?

#95

Post by yeukhon »

ProblemFactory wrote: post #84
Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

The Algorithm is a great solution - breaking the pattern would require password leaks from 3-4 different sites, and a human to spend time puzzling over it. For automated bots the passwords look unique. What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you…

> What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you are up to?

Good question. I just start with 2 (yes, that's weird) and then increment every time or choose the symbol so I eventually exhaust. This is the same question for unique password per different types/groups of websites. The good thing is more websites have abandoned the annoying security question/answer when it comes to forgot password/forgot username. Just straight to SMS/email. For example I cannot remember my cable provider's online account password. The policy is just ridiculous, so I use "forgot password" every single time. Email only, quick and simple.

Please for everyone reading this - please abandon security questions as a requirement and stop being so hard on password requirement such as limiting the length (Twilio I am looking at you, yes). Just ask for a long password and give hints to users how to choose a good password. While the argument for complex password is to increase the search entropy, let's spend more time on securing your server and mitigating common attacks. Users will probably just append a number. So "myAwesomePassword$" is easy to try once "myAwesomePassword" is compromised from another service. Educate your users.

Let user be responsible; I have my "secure" complex rules for password, let me be in control, I don't want to bend to meet your requirement.

Another alternative is always ask for a one-time password (but a lot of users will find that very inconvenience). Choose one.

Re: Ask HN: Does anyone use an alternative to a password manager?

#96

Post by c0l0 »

ricardobeat wrote: post #44

I have a folder with encrypted text files containing a password for each service. It is available locally and backed up to the cloud (with another layer of encryption). The key is in my head, no backup. A script lists all files through fzf[1] which lets me find and select the right one very quickly, then copy to clipboard (expires after a few s). In a laptop the whole process of switching to terminal and grabbing a p…

I have a plain-text file storing various important information, amongst it passwords, on an encrypted LUKS volume at a server running in my basement that I can access via SSH from anywhere in the world. The "password manager" for that is a simple bash wrapper around an awk one-liner that's called `secret` and placed in my $PATH.

  #!/bin/bash
  secrets_source='/home/colo/.path_to_secrets_file'
  [[ -z ${1} ]] && {
      echo "Missing subject."
      exit 1
  }
  
  [[ ${1} = -e ]] && exec /usr/bin/vim "${secrets_source}"
  exec /usr/bin/awk 'tolower($0) ~ /^= .*'"${1}"'/,/^$/' "${secrets_source}"
The ad-hoc format for records stored in the secrets_source is:

  = some identifier
  free text
  more free text
  blah blah foobar
  
  = another identifier
  more free text
  fizzbuzz
An empty line (or EOF) concludes a record.

`secret ` performs a regex search over all identifiers and prints all matching records found. `secret -e` invokes my editor to add new records/view all records in vim.

If someone were to extend this with GPG, they could have encrypted data at rest while the host is up with the LUKS volume's contained fs mounted. I don't feel a pressing need for that, however.

Re: Ask HN: Does anyone use an alternative to a password manager?

#97

Post by proaralyst »

beojan wrote: post #79
nullterminator wrote: post #45

I use Linux, Windows, and Android. I decided on Pass [1] and it's been working really well for me. I have a dedicated PGP key that encrypts all my passwords, and they're stored on my own git server. On Linux I use the pass command, on Windows I use QtPass [2], and on Android I use Password Store [3] and OpenKeychain [4] (for the PGP key). My "master password" is the password for the PGP key, and I type it each time I…

Why use a PGP key instead of symmetric encryption (either with a random key encrypted with your master password, or a key derived from your master password)?

Insertion/generation don't prompt you for your password.

Re: Ask HN: Does anyone use an alternative to a password manager?

#98

Post by mud_dauber »

Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

I use the same algorithm and am very happy with it.

Re: Ask HN: Does anyone use an alternative to a password manager?

#100

Post by jhasse »

NoGravitas wrote: post #85

I'm a bit surprised at all of the people suggesting "remember one password, and mutate it with an algorithm based on the website name". That means that if you have to invalidate one password for any reason, you have to change all of them. On every service that you use. Do people really do this?

Yes, I really do this. No one said that this method isn't without its disadvantages.
Post reply on HN