191–200 of 250 posts
1. To generate a password i use randompass, which pulls stuff out of /dev/urandom, massages it and dumps it onto the screen.
2. I add that password to a plaintext login : password file located on an encrypted disk on my laptop
3. My password search tool is "grep"
I think I share your same concerns: I don't want to rely on any single application for my entire security (and some passwords are my entire security). I recently blogged about the algo I use [1], it's a simple deterministic base64(sha256(.)), which is easy to remember and apply everywhere. The post was pretty successful compared to my usual views/comments, and with a group of friends (all former researcher in securit…
What do you do for situations where a service has force-expired your password?
This said, you can use the counter. The counter isn't necessary an incremental int, you can also for example use yymm if you want to "auto renew" your password every month.
So far we haven't implemented anything in MemPa, but we were discussing this last option. Would be great to hear what do you think.
I used a small script to generate my passwords : I choose a simple password, I append the domain and I hash the string. I take the first 15 characters of the hash as a password. I find it quite convenient and easy to remember ! sha256("password"+domain)
[1] https://hackernoon.com/mempa-a-modern-deterministic-password...
I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface! With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual ser…
> If one password is compromised, they all are. The point of an algorithm as opposed to a single shared password is that this isn't true. With a basic algorithm, you can avoid automated attacks based on password dumps. With a more complex algorithm, even a determined attacker targeting you would have a really hard time figuring it out. Regardless, it probably would need to be a few passwords, not just one. Also, any…
I see an algorithm as a single point of failure of its own, in the case where a determined bad actor has direct access to your algorithm. At that point you've traded potentially complex passwords for intentionally weak and guessable passwords. Yes, rate limits and other protections may mitigate the threat, but once an attacker has access to your algorithm, they quite possibly have a much easier password cracking game to play.
From that perspective, and from the other direction, most algorithms that I've seen make me a single point of failure. I still have to remember a set of weak passwords for every site I use. The algorithm may work to step up the overall complexity and entropy of the weak passwords I use, but I still have to rely on somewhat faulty memory for a series of passwords. Even if that information is easily accessible there's still a lot of variables and forgetfulness that can take place and sometimes it would be me trying to password crack my own passwords (Did I use "facebook" or "fb" or maybe it was "facebook.com"? Was this was password rotation number 12 or 13 or second quarter 2015?). Add in the encoding difficulties to make sure that you can generate a password within the arbitrary complexity requirements of sites themselves (I need a weak password that generates a strong password with no SQL keyword symbols, but at least one capital letter, one emoji, and at least one platitude to an elder god), and you really are just trading one set of complex passwords for an equally arbitrary set of weak passwords (to get the right output I had to use "facebook@2015", transpose odd characters into the Unicode astral plane by divination, and truncate the output to the first 12 code points).
A benefit to a password manager is that my own faulty memory isn't itself a part of the threat model. I don't have to maintain a list of weak passwords and/or additional "clean up steps" to feed to an algorithm.
On the flipside, I don't know anything about my Facebook password inside my password database. I just copy and paste it when it is needed. There are threat models where that is a benefit. If I'm asked, on the spot, in a location without access to devices which I trust to produce my Facebook password, I cannot, because I honestly do not know it. A judge or over zealous customs agent can't make me remember what I don't know. How likely of a threat that is, I don't know, but it's a threat model that an algorithm can't pass if a judge considers your weak password and knowledge of your algorithm as a password that you know and must divulge. That's of course entirely speculation, there's no US precedent on that yet, but on the flipside there are US precedents protecting "I don't have the right device on me", and most bets are off when your threat model includes a government actor specifically threatening you. But it's still a fringe benefit to certain threat models, ymmv.
Not to make a long comment unnecessarily longer, but there are mitigations available based on your threat model to keep a password manager from being a single point of failure:
* Use multiple databases with different master passwords for different threat models/risk level assessments/use cases.
* Explore options for synchronization systems based on your threat models. For instance, I might have a low risk database synchronized with OneDrive/GDrive/Dropbox, but keep riskier databases in various combinations of Keybase file shares, or Resilio Sync encrypted shares, or a lone self-destructible USB thumb drive primarily kept in a safety deposit box. Similarly many file sharing systems allow you the means to explicitly manage which devices have which files/shares, and you can use that to your advantage as well.
(I've stuck with KeePass over the years because it offers a lot of flexibility in how I maintain and sync my constellation of password databases.)
We really need passchange.js: an open source collection of headless JS scripts that can programmatically change your password on a given website. Then you would continuously rotate _all_ your managed passwords as well as your master. Not a panacea, but significantly minimizes the length of a theoretical breach.
Please don't get me wrong, it would be great to have a service to centralize all your passwords including rotation, but this already exists. It's Google/Facebook if you choose to use oauth to sign in into other sites.
If this kind of api/js would exist and work, an attacker could exploit it to automatically change user's password.
Note that changing password is often used also as a simple mechanism to log out all the sessions (simple = easy to understand for the end user).
In summary, I really hope all website would do all they can do to protect their change password endpoints from automatic tools.
For me, passwords need to exist and need to be remembered, because if this is not the case, then many other security assumptions fail. With this I don't want to say that the current state of affairs is good, I definitely think that we need to invest in more mechanisms to help users remember their passwords, or reuse them in secure ways.
Earlier quoted context omitted.
So... your passwords are 15 characters of the combination 0-9, a-f?
Yes. But I do add a special characeter and/or a maj at a certain place when it is needed
$ perl -e 'use Digest::SHA "sha256_base64"; print sha256_base64("master_password mail.google.com"), "\n";'
g/sOxZfr2DFE12r8Gs/D0bhwat5kku41L+kFmuCCQOoEarlier quoted context omitted.
And self-hosted can put the files in Apple's iCloud service, making it accessible on your phone. At least, that's how my own is still working.
Your weakest link is probably now iCloud, considering how easily and often it gets hacked...
For me, https://www.passwordstore.org/ and a Yubikey is the best setup I've tried. It's quite a lot of work to set it up though.
So, how does this work on a smart device? Do you plug the Yubikey into an OTG, or do you just not access anything on your phone?