I use my browser’s password manager, which works across devices. It’s Mozilla, so I trust that they take the security of my data very seriously.
Ask HN: Does anyone use an alternative to a password manager?
101–110 of 250 posts
Re: Ask HN: Does anyone use an alternative to a password manager?
#102I use https://bixense.com/pwcalculator/ (GUI for hashing alias + site) and dedicated passwords for services I need to access more often.
Re: Ask HN: Does anyone use an alternative to a password manager?
#103I use https://bixense.com/pwcalculator/ (GUI for hashing alias + site) and dedicated passwords for services I need to access more often.
Thanks for sharing this; I've been doing the same thing mentally for years to get around a memory issue and a need for unique passwords.
Re: Ask HN: Does anyone use an alternative to a password manager?
#104I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…
[deleted]
Re: Ask HN: Does anyone use an alternative to a password manager?
#105Pen and paper. I keep a small notebook wedged under my desk and a back-up in a fire safe.
Re: Ask HN: Does anyone use an alternative to a password manager?
#106I'm surprised at how little advocacy there is for 1password.
Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm.
It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account.
If anything is truly important, it will have 2 factor authentication.
If someone has access to my unlocked physical machine and an unlocked 1password UI, I'm screwed. Additionally, they could use the wrench approach [0] to gain my credentials.
This is not a use-case I'm actively trying to prevent. Nor is protection against state-level actors targeting me in particular.
Further benefit of 1password: my wife and I both use certain shared logins to access things like credit card accounts.
Instead of me having to get her on board with my password book, or special algorithm, I can just move a login into our shared password vault.
I suspect most people reading this are in a similar boat - we're more than happy to pay a few dollars to hire millions of dollars of specialized security knowledge to outsource this problem for us.
This is just too mundane a solution for most people to comment on.
Long live 1Password!
Re: Ask HN: Does anyone use an alternative to a password manager?
#107pen and paper
rofl. I have around 1300 passwords in Keepass, most of them are 20 characters including symbols. Good luck writing those passwords every time you need to login...
I used pen and paper for a decade now. I have a folder and preprinted forms where I note passwords with pens. The folder had like 20 sheets. This worked pretty well and is without doubt the most secure variant -- I always have my folder with me. Note that this only stores the important passwords. I use weak and dumb passwords for non-important services (similar to disposable email boxes).
Anyway I want to change to a paperless variant due to the increasing amount of "important" services.
Re: Ask HN: Does anyone use an alternative to a password manager?
#108I'm surprised at how little advocacy there is for 1password. Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm . It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account. If anyth…
My wife and I do the same which is hugely convenient. You can store more than website logins as well, such as credit card numbers, drivers license details or our passport information.
We do a lot of travel and financial witchcraft so having full access to each other’s into at the unlock of a thumbprint is extremely convenient.
We also have a team vault at FarmLogs which is hugely helpful for sharing access to singular accounts.
It’s such a valuable tool that I don’t even think about paying for it.
Re: Ask HN: Does anyone use an alternative to a password manager?
#109Earlier quoted context omitted.
I do basically the same thing, and have for years also. My only frustration with this is that with some sites, due to arcane password restrictions, the algorithm either isn't implementable, or is only implementable in such a way I won't remember. So 90% of the time the strategy works great, and in 10% of the time it fails due to idiosyncracies of the sites involved. I hate the stupid restrictions sites place on passw…
I have the same issue. My full password is over 20 characters, but some websites restrict to less than that or don't accept the special character that I use.
I have the exact same issue, mine also being over 20 characters which used to be above the length limit on a Microsoft account used to be 16 characters, so glad they changed that
Re: Ask HN: Does anyone use an alternative to a password manager?
#110An idea for a side project I had for some time: Use Raspberry Pi Zero connected to the PC as a password manager . Explanation: RPi Zero supports OTG and can emulate USB keyboard (in other words, it can "type" your passwords for you). Never got too deep into this idea, but it shouldn't be extremely hard to implement. Need to create some mechanism to allow the web browser to ask the RPi for a password for a certain sit…
Funny, I am doing something like that now, but using an smartphone with a fingerprint reader, instead of a Pi and sending the password through Bluetooth (adding USB might be a good idea, though). My problem with the Pi is that it is another bulky device to carry or loose, even the Pi Zero.
My implementation still has lots of security breaches and I don't want to publish something so fragile. I still need to implement fingerprint and time-based authentication. Therefore it still is vulnerable to MITM attacks.
As soon as I have something more robust I'll post it here.
Do you have more ideas to suggest?