Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#181

Post by nicwolff »

At this point I usually let iCloud Keychain generate, store, and sync passwords, but for some sites I still use a Javascript password generator [0] I originally wrote in 2003 or so [1] – I may be the inventor of in-browser hash-based password generation. It spawned a bunch of similar sites, and it's still useful, so in that sense it has been very successful – but it has all the frustrations described by others here: updating passwords is a pain, "special characters" have to be added, &c.

[0] http://angel.net/~nic/passwd.current.html

[1] https://web.archive.org/web/20031222201145/http://angel.net/...

Re: Ask HN: Does anyone use an alternative to a password manager?

#182

Post by mikestew »

SnowingXIV wrote: post #178
wonder_er wrote: post #106

I'm surprised at how little advocacy there is for 1password. Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm . It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account. If anyth…

I switched to this after being a long time lastpass user, I'm regretting it. It's visually a lot better but it is terrible at generating passwords and saving them. On both windows and mac with chrome I click the 1pass icon and click generate (nothing happens). If something happens it shows up as a new entry if I go into the vault with no site or anything just a random string that I then maybe copy paste? (ugh). There…

it is terrible at generating passwords and saving them

1Password used to be better at this. Generating a password was pretty obvious, it was consistent across mobile/desktop, and the save workflow was better. It’s been several versions since that was the case (v. 3, maybe?). Now I have to hunt for the functionality and then it gets put someplace with no reference to what it is.

Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc

I know the Mac version will give you all of this. Compromised sites, dupes, weak passwords, old passwords, there’s a filter for each, and I think you can make your own. It does not appear that you get this on mobile, though.

Re: Ask HN: Does anyone use an alternative to a password manager?

#183

Post by kentbrew »

ecesena wrote: post #179

I think I share your same concerns: I don't want to rely on any single application for my entire security (and some passwords are my entire security). I recently blogged about the algo I use [1], it's a simple deterministic base64(sha256(.)), which is easy to remember and apply everywhere. The post was pretty successful compared to my usual views/comments, and with a group of friends (all former researcher in securit…

What do you do for situations where a service has force-expired your password?

Re: Ask HN: Does anyone use an alternative to a password manager?

#184

Post by [deleted] »

mikestew wrote: post #182
SnowingXIV wrote: post #178

Earlier quoted context omitted.

I switched to this after being a long time lastpass user, I'm regretting it. It's visually a lot better but it is terrible at generating passwords and saving them. On both windows and mac with chrome I click the 1pass icon and click generate (nothing happens). If something happens it shows up as a new entry if I go into the vault with no site or anything just a random string that I then maybe copy paste? (ugh). There…

it is terrible at generating passwords and saving them 1Password used to be better at this. Generating a password was pretty obvious, it was consistent across mobile/desktop, and the save workflow was better. It’s been several versions since that was the case (v. 3, maybe?). Now I have to hunt for the functionality and then it gets put someplace with no reference to what it is. Plus no check on password integrity or…

[deleted]

Re: Ask HN: Does anyone use an alternative to a password manager?

#185

Post by wonder_er »

SnowingXIV wrote: post #178
wonder_er wrote: post #106

I'm surprised at how little advocacy there is for 1password. Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm . It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account. If anyth…

I switched to this after being a long time lastpass user, I'm regretting it. It's visually a lot better but it is terrible at generating passwords and saving them. On both windows and mac with chrome I click the 1pass icon and click generate (nothing happens). If something happens it shows up as a new entry if I go into the vault with no site or anything just a random string that I then maybe copy paste? (ugh). There…

Hm. I just checked on both of these comments, and it seems 1password manages both quite well.

re: password generation in-browser - this is working just fine for me. [0]

And re: pw integrity or strength - this might not be everything you're looking for, but it's close.

under a 'Security Audit' tab, it has categories for:

- Watchtower (logins associated w/sites that are known vulnurable/exploited)

- Weak Passwords

- Duplicates

- 3+ year old PWs

- 1-3 year old pws

- 6-12 month old pws.

I'm not trying to be a 1password apologist, but I find it to cover my day-to-day use _very_ well. To be sure, I still tweak things in the UI at times. It doesn't capture login URLs perfectly all the time. Etc. But it's pretty good.

[0] https://cl.ly/07072T0e1P2C/Add_Comment___Hacker_News.jpg

Re: Ask HN: Does anyone use an alternative to a password manager?

#186

Post by nkristoffersen »

smt88 wrote: post #174
falcolas wrote: post #143

Earlier quoted context omitted.

And self-hosted can put the files in Apple's iCloud service, making it accessible on your phone. At least, that's how my own is still working.

Your weakest link is probably now iCloud, considering how easily and often it gets hacked...

Which is never, right? Has iCloud actually been “hacked” in the “Yahoo” sense of the word?

I ask because I use iCloud heavily. Nearly 1TB of photos/videos and now use 1Password with iCloud sync.

Re: Ask HN: Does anyone use an alternative to a password manager?

#188

Post by ProblemFactory »

h4waii wrote: post #146
ProblemFactory wrote: post #84

Earlier quoted context omitted.

The Algorithm is a great solution - breaking the pattern would require password leaks from 3-4 different sites, and a human to spend time puzzling over it. For automated bots the passwords look unique. What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you…

Ehh. Any password cracker worth their salt would be able to use rules to break hashes created by "The Algorithm", especially easier once the base word has been figured out or supplied by a single plain-text leak.

Yes, the algorithm is breakable with a few examples to figure out the base word and the pattern. But this requires human attention at your personal algorithm.

Unless you are enough of a celebrity or public figure to be personally targeted, nobody will bother. A password leak is going to have 100 million accounts in it, at least 50% of these reused without modification at other websites. Any automated bots and spammers will just try the exact passwords on other sites. If it doesn't work, they move on to the next account and password, instead of trying to guess modifications of non-working passwords.

Re: Ask HN: Does anyone use an alternative to a password manager?

#189

Post by natch »

kqr wrote: post #65
natch wrote: post #24

I have a couple scripts, 'add' and 'get', which respectively add or get an entry associated with some keys to a text file. An example line in the text file looks like this: facebook password: [base64:U2FsdGVkX1/T8CoWmfDOoaapE5lGj/fqHE3s8NohnriGajnPrCzWikCneU/u7] Anyone thinking of trying to crack that, well good luck. I removed and twiddled a few characters from it, as if it wasn't hard enough already. Oh but here's…

Why generate symbols that are not permitted anyway? You'd lose nothing by emitting the base16 encoding of the symbol.

Have you even used the internet much? Some sites do require symbols. And some sites have ridiculous rules that your suggestion would also not help with. Also, restricting yourself to the 16 characters in hex encoding makes your passwords that much easier to guess.

Re: Ask HN: Does anyone use an alternative to a password manager?

#190

Post by cJ0th »

laci27 wrote: post #63
duncan_bayne wrote: post #19

Yep - a text file, encrypted with ccrypt. Happily, Emacs knows how to open and save ccrypt-ed files.

Why would you use an encrypted file when you have free, open source password managers like Keepass? Every time you login somewhere, you open the file, search for the site, copy the password and paste it in the browser? What do you do when you need a password on your phone? What do you do to clean your memory after the paste operation to reduce the likelyhood of memory trojans reading it?

> What do you do when you need a password on your phone?

dl the file from dropbox and decrypt it via termux /s

Post reply on HN