For me, https://www.passwordstore.org/ and a Yubikey is the best setup I've tried. It's quite a lot of work to set it up though.
What if you lose your Yubikey?
[deleted]
Ask HN: Does anyone use an alternative to a password manager?
161–170 of 250 posts
Re: Ask HN: Does anyone use an alternative to a password manager?
#162I use https://bixense.com/pwcalculator/ (GUI for hashing alias + site) and dedicated passwords for services I need to access more often.
This seems to me like a very clean solution, is there a Chrome extension version of something like this? I'd love to tap on a password field, enter my secret key, and have it autofill based on the domain of the page.
That would be a good idea! I haven't written a Chrome extension yet, but I'm planning to do an Android and iOS app next.
Re: Ask HN: Does anyone use an alternative to a password manager?
#163I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…
Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to and even realize that your password has some sort of generation algorithm, but it would be a bit more secure to hash that password in some way. That's why I like using LessPass (even though people talk a bit of shit about it whenever it's mentioned on HackerNe…
You can always enhance the algorithm. For example, use multiple base password, and arrange them based on the servicename. So hunter2 for everything that starts with h or a-c or a-k or with 5 characters. It's your choice how complicated it becomes. Additionally you can mutate the servicepart. Like break it up every n characters, or every syllable and add some service-specific value in. Maybe use the lenght of the servicename multiplied with the number of syllables plus 4. You could also use a random characterstring, lets say the ones from numberrow, and calculate entrys whith those numbers. Like, move by n syllables for every char you add. It's not really hard to make a rather complicate algirithm with the tools you have around you. It's just cumbersome to remember and execute it in case you need it. So unless you really fear to be personal targeted, it's not worth the pain.
Re: Ask HN: Does anyone use an alternative to a password manager?
#164I try and mitigate the password management single point of failure with two factor authentication.
Obviously that it not an option for every site but access to my password manager, alone, will not provide access to my email (which lets me rest all my accounts) or my bank etc
Of course I use two factor on the manager too.
It doesn't completely solve the problem but I haven't found a better alternative (that works for me)
Re: Ask HN: Does anyone use an alternative to a password manager?
#165I'm a bit surprised at all of the people suggesting "remember one password, and mutate it with an algorithm based on the website name". That means that if you have to invalidate one password for any reason, you have to change all of them. On every service that you use. Do people really do this?
Yes. There are some passwords that I have to remember since putting them into a password manager is not possible.
In what situation would putting them in a password manager be impossible?
Re: Ask HN: Does anyone use an alternative to a password manager?
#166I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…
This is very very similar to what I do and it works out great!
Re: Ask HN: Does anyone use an alternative to a password manager?
#167Earlier quoted context omitted.
I've been happily using 1Password 4 for many years, my credentials are encrypted and synced via Dropbox. But I hear the latest versions require you to use their cloud service, the self-hosted version is no longer available. Is that true? I use 1Password for not only credentials but as a document vault for everything from passports, birth certificates, anything else that falls under "needed after the house burns down"…
Whilst they do have a cloud-hosted subscription service, the self hosted version is still available.
How are you defining "self hosted" here?
The newest version of the Windows app doesn't support creating or opening local vaults, only storing data in their cloud.
They also no longer offer perpetual/non-subscription licenses, including for the older version that supports local vaults.
At the very least the first would be a requirement for any sort of "self hosted" setup.
Re: Ask HN: Does anyone use an alternative to a password manager?
#168I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…
Absolutely! I've been using Keepass soccer 2011 and I would highly recommend it to anyone. It's available for Windows, Android (Keepass2Android), Ubuntu Linux (Keepass2) and I have the encrypted database synchronised via Google. Seamless setup and operation. A must have in this modern age.
On Linux I have recently switched to KeePassxc because it is screaming fast, doesn't require hundreds of megabytes of mono libs, and it is maintained.
Re: Ask HN: Does anyone use an alternative to a password manager?
#169If you're worried about storing your passwords somewhere where they could be compromised, one alternative is to simply not store them:
1. Generate a long random password.
2. Use that password once, but don't make any effort to store or remember it.
3. When you need access to the service, use the Forgot Password flow. Return to Step 1.
This is admittedly inconvenient, especially on mobile, and it won't work well if you routinely use devices that cannot access your email. But...it is an alternative approach that removes the need for a password manager.
In my personal experience, this approach has worked well for services I use rarely, especially those with good Forgot Password flows or long remember-me session times.
See also: Passwordless[0] is a Node library that discusses a similar approach to authentication from the service's perspective.
Re: Ask HN: Does anyone use an alternative to a password manager?
#170Earlier quoted context omitted.
Also, you don't want the freemium business model because: 1) passwords are a serious stuff, so you want serious people to to some serious work behind your PM (AKA, it can't be free); 2) passwords are a too fundamental tool of our digital existences to have a monthly-based subscription. The idea of being locked out of your services when you can't afford to pay the monthly fee is just horrible.
agreed! In their defense, the old model wasn't freemium , it was a one-time fee. (I think it was $40 or $50 when I bought it.) That said, over the time horizon of many years, $40 doesn't cover much at all. For the reasons you mentioned, I felt a sense of relief when I moved over to the monthly model.
I totally understand why they need/want to change their pricing model, and support it even. I don't understand why they've bundled a change in the product along with it and that's what I take issue with.
I'd happily pay them $5/mo to continue using their product as I've been using it - with local vaults, not with their cloud product.
I won't take their product for free if it comes with a forced "upgrade" to the cloud service.