I'm using Trezor hardware wallet which also has password manager (https://trezor.io/passwords/). I'm storing important secrets there (e.g. master password to my regular password manager which is Avast Passwords).
Ask HN: Does anyone use an alternative to a password manager?
171–180 of 250 posts
Re: Ask HN: Does anyone use an alternative to a password manager?
#172Until about 6 months ago, I used a physical password manager: a small notebook that I kept with me. It posed a greater risk to a physical attack (theft or snooping), but I accepted that risk over using shared passwords across services.
I've started using LastPass as a replacement for this, and have been happy with it.
Re: Ask HN: Does anyone use an alternative to a password manager?
#173I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…
> If one password is compromised, they all are.
The point of an algorithm as opposed to a single shared password is that this isn't true. With a basic algorithm, you can avoid automated attacks based on password dumps. With a more complex algorithm, even a determined attacker targeting you would have a really hard time figuring it out. Regardless, it probably would need to be a few passwords, not just one. Also, any good web service will implement rate limiting and other protective measures, so brute force attacks are unlikely to work.
The counterargument to "minimize attack surface" is "avoid single points of failure", and that includes both attacks and accidentally losing access to all of your passwords. What if I drop my phone and/or laptop in a lake? What if I forget my master password somehow? What if someone installs a keylogger and gets my master password? What if I accidentally install a malware version of the password manager client that steals my password?
Not that I necessarily think that an algorithm is better overall than a password manager, but I think it's not as obvious a decision as you're claiming.
Re: Ask HN: Does anyone use an alternative to a password manager?
#174Earlier quoted context omitted.
Whilst they do have a cloud-hosted subscription service, the self hosted version is still available.
And self-hosted can put the files in Apple's iCloud service, making it accessible on your phone. At least, that's how my own is still working.
Your weakest link is probably now iCloud, considering how easily and often it gets hacked...
Re: Ask HN: Does anyone use an alternative to a password manager?
#175I assume all my passwords will be leaked/known and don't store anything sensitive without 2FA, ideally not SMS 2FA. A password alone is never secure.
This is almost totally impossible for most people. Banks have notoriously terrible password and 2FA policies, so even in the unlikely event that they allow a long/strong password, you're stuck without 2FA (or with SMS 2FA).
Re: Ask HN: Does anyone use an alternative to a password manager?
#176Earlier quoted context omitted.
Yes. There are some passwords that I have to remember since putting them into a password manager is not possible.
In what situation would putting them in a password manager be impossible?
You need to somehow have access to the backup of your database (in my case KeePass) in case you lose it. If you put the password of the access itself in the manager you are in a deadlock. It is much easier to end up in a deadlock situation like this than one might think. So carefully play through restoring your backups in the worst case scenario.
In my case, I am using Google Drive as my Backup Storage. If I were to put my Gmail Password in the manager I'd be locked out in the worst case and would not have access to my backup.
Re: Ask HN: Does anyone use an alternative to a password manager?
#177Earlier quoted context omitted.
I have been working on-and-(mostly-)off on something like this for a while: https://github.com/scoates/celobox Wish I had more time to spend on it.
This is a fantastic idea, just a simple config file which describes how to change a password for a site, which different programs can then interpret differently.
Thanks. Yeah; that's the idea for bootstrapping. At some point, I'd love it if sites themselves published APIs or at least manifests (similar to /robots.txt or favicon or a URL in a HTTP header, etc.) of how to programmatically change passwords.
A real problem I ran into is that a full browser is required for many operations, now. Instagram.com, for example, is completely opaque to non-DOM+JS browsers. Right down to the shamefully empty `` block.
Re: Ask HN: Does anyone use an alternative to a password manager?
#178I'm surprised at how little advocacy there is for 1password. Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm . It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account. If anyth…
I switched to this after being a long time lastpass user, I'm regretting it. It's visually a lot better but it is terrible at generating passwords and saving them. On both windows and mac with chrome I click the 1pass icon and click generate (nothing happens). If something happens it shows up as a new entry if I go into the vault with no site or anything just a random string that I then maybe copy paste? (ugh). There also is nothing that pops up that lets me alter the specifications for the randomly generated password. Lastpass did an amazing job of this, 1password just seems broken all over the place.
When I did the export/import it ruined tons of passwords because if it had an ampersand symbol (&) it turned it into & resulting in me editing tons of passwords manually. It sucks at saving passwords too, lastpass just worked.
Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc. So, basically I went from free but kinda ugly to pretty but broken and more $. This has been the worst trade deal in the history of trade deals, maybe ever.
YMMV but I wish I didn't switch and to move back would be another annoyance that I might do if I didn't just pay for the year.
Re: Ask HN: Does anyone use an alternative to a password manager?
#179I think I share your same concerns: I don't want to rely on any single application for my entire security (and some passwords are my entire security).
I recently blogged about the algo I use [1], it's a simple deterministic base64(sha256(.)), which is easy to remember and apply everywhere.
The post was pretty successful compared to my usual views/comments, and with a group of friends (all former researcher in security) we started building a MemPa [2], which we just released for iOS/Android.
[1] https://hackernoon.com/how-i-manage-my-passwords-technical-v...
[2] https://hackernoon.com/mempa-a-modern-deterministic-password...
Re: Ask HN: Does anyone use an alternative to a password manager?
#180I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…
What do you do for forced password change requirements? Does your threat model include anything NOT bulk, ie where a human would see a password and guess the pattern? Have you tried any of the password managers that have integrations, to automate password changes in case of failure? Have you ever heard of the security concept of minimizing your attack surface?
My algorithm gives me flexibility to increment the password. I've had to do this before and almost all the time, I use it enough that I simply remember, "oh this banking site is incremented twice".
I have no opinion on password managers. It's just something I don't want to commit time to. My solution is easy and requires no management on my part. Ie. no software or hardware or anything to maintain.