Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#131

Post by ohthehugemanate »

I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface!

With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual service.

Compare it to an algorithm, where your attack surface is "every service." If one password is compromised, they all are. Then you have to change them all manually, and remember what's been changed, when.

In an age of great open source options like bitwarden, Keepass, and unix pass, there's no excuse for using an algorithm anymore.

Re: Ask HN: Does anyone use an alternative to a password manager?

#132

Post by ryan-c »

jhasse wrote: post #102

I use https://bixense.com/pwcalculator/ (GUI for hashing alias + site) and dedicated passwords for services I need to access more often.

I looked at the algorithm this thing uses - it's just base64(sha1([master password][alias])) with some data munging to deal with endian issues. Would be trivial to do GPU accelerated cracking.

Re: Ask HN: Does anyone use an alternative to a password manager?

#133

Post by rbcgerard »

JoeAltmaier wrote: post #124

Used to have a car with a digital lock; every time you exited, you punched a code to lock, punch again to unlock when you return. Most folks would just give up and punch 1111 or some such. Instead I used the address where I'd parked. Didn't have to remember; didn't have to invent anything; different code fore every place I went.

what type of car was that? I've never heard of a car having a different password every time!

Re: Ask HN: Does anyone use an alternative to a password manager?

#134

Post by Kequc »

ryan-c wrote: post #127
Kequc wrote: post #119

Earlier quoted context omitted.

This seems to me like a very clean solution, is there a Chrome extension version of something like this? I'd love to tap on a password field, enter my secret key, and have it autofill based on the domain of the page.

If someone suspects such a solution is being used, they can attempt to crack the master password. Combined with the weakness of this not supporting forced password rotation or varying complexity requirements well, it's really not a good solution.

Why would anyone suspect that? You're talking about what 1 in several million users? All you have to be is above the threshold of "easy to hack". I'd like to be referred to such a thing if there is one already.

Re: Ask HN: Does anyone use an alternative to a password manager?

#135

Post by zimbatm »

"Just use a password manager" is actually a simplification for doing proper threat modelling because most people don't bother thinking about it.

For each site you have to consider; what is the worst thing that could happen if somebody gain access to that account? Do you have a meaningful online presence on the website? Did you enter private information that you don't want to go out? Did you provide your credit card to the site? It would actually be useful if sites where classified by the type of information and access that they require.

Another short answer would be: memorize your computer, email and password-manager passwords. Use the password manager for day-to-day sites. Add a second factor for juicy targets like net banking. For all the other sites, generate a random string and throw it away. Use password reset the next time you want to log into it.

Re: Ask HN: Does anyone use an alternative to a password manager?

#136

Post by rrebelo »

h4waii wrote: post #123
rrebelo wrote: post #110

Earlier quoted context omitted.

Funny, I am doing something like that now, but using an smartphone with a fingerprint reader, instead of a Pi and sending the password through Bluetooth (adding USB might be a good idea, though). My problem with the Pi is that it is another bulky device to carry or loose, even the Pi Zero. My implementation still has lots of security breaches and I don't want to publish something so fragile. I still need to implement…

Since you're already using a phone for this, why not just use Keepass2Android USB Plugin [0] which emulates a keyboard and "types" the password. Requires Android, and probably a device with kernel modules for USB HID. You won't have to worry about the security and integrity of your Bluetooth connection and the risk of an external sniffer -- but you'll have consider if you trust the computer you're plugging it in to.…

I love and use KeePass on my PC, although not on Android. Will try it, thanks for the tip.

However, a problem I have with KeePass is that I can't get my wife to use it. It is too complicated for her. Even the idea of plugging the smartphone through USB is already a "no" for her. With Bluetooth she might not even need to take the phone out of her pocket.

Re: Ask HN: Does anyone use an alternative to a password manager?

#137

Post by arca_vorago »

I do have a basic algorithm in my head for when I don't have my password manager of choice, keepassxc (https://github.com/keepassxreboot/keepassxc) on hand, but I highly prefer to just keep seperate keepassxc databases and secure them by keeping them stored on fde removable media (microsdcards are easily hidden).

Re: Ask HN: Does anyone use an alternative to a password manager?

#138

Post by arunc »

ohthehugemanate wrote: post #131

I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…

Absolutely! I've been using Keepass soccer 2011 and I would highly recommend it to anyone. It's available for Windows, Android (Keepass2Android), Ubuntu Linux (Keepass2) and I have the encrypted database synchronised via Google. Seamless setup and operation. A must have in this modern age.

Re: Ask HN: Does anyone use an alternative to a password manager?

#139

Post by BareNakedCoder »

I use https://securemypw.appspot.com (because I wrote it).

I need to remember just 1 good password (that I don't use anywhere else). I use it to encrpyt different passwords for different uses (gmail, banking, etc). I put the url with encrypted password in my bookmarks and a google doc (to share with my wife).

To hack me, the attacker would need get both the link (from my laptop's bookmarks) or from the google doc ... and then would need to guess the password to decrypt it.

Re: Ask HN: Does anyone use an alternative to a password manager?

#140

Post by 24gttghh »

I used to open a text editor and mash on the keyboard until I had an 8-12char password. I'd then type that sequence out again 10-20 times until it was burned into my memory. Then I close the editor without saving it :) Let your subconscious "muscle-memory" remember the password for you! Bonus point: if someone tries to coerce you into revealing your password, you honestly won't know what it is without typing it out. This doesn't seem to scale beyond doing it a few times as they get hard to remember, but it can make for a few secure email/banking passwords.
Post reply on HN