21–30 of 117 posts
That's why I don't use password managers. That's giving one entity too much power over everything I own.
Do you simply remember hundreds of random passwords?
The best password manager is your own salting algorithm and memory.
This can be an OK strategy as long as your salting algorithm is not easy enough to figure out by looking at a few password breaches that you (now or in the future) are exposed by.
It can work if you’re smart about the algorithm, but if someone can guess your algorithm by looking at a few leaked passwords, it can provide a false sense of security.
That's why I don't use password managers. That's giving one entity too much power over everything I own.
Do you simply remember hundreds of random passwords?
-- Pen and paper? It is still a thing and cannot be stolen online.
-- If you are afraid your family will access it without your knowledge, use tamper evident bag and a notepad to make notes of bag serial numbers. This prevents anybody from accessing it without your knowledge.
-- Split the password into components so that even if somebody gets access to the piece of paper with the password they still can't log in. I make a note of the variable part of the password and remember a different prefixes/suffixes. I use different prefixes/suffixes for different classes of accounts. For most critical accounts I don't reuse anything.
-- Use hardware (yubikeys) as second factor, to lessen pressure on the password. Unfortunately almost nobody implements these well. In most cases it is possible to turn off the second factor without presenting second factor which basically nullifies the value of it. If you use second factor on a site that implements it well, remember to have MULTIPLE copies of it. Keep it in triplicate, one with you, one in tamper evident bag and one offsite.
Earlier quoted context omitted.
Do you simply remember hundreds of random passwords?
I have couple of ways of dealing with the problem. -- Pen and paper? It is still a thing and cannot be stolen online. -- If you are afraid your family will access it without your knowledge, use tamper evident bag and a notepad to make notes of bag serial numbers. This prevents anybody from accessing it without your knowledge. -- Split the password into components so that even if somebody gets access to the piece of p…
Earlier quoted context omitted.
Do you simply remember hundreds of random passwords?
Just note them down in a book? I know, it sounds stupid, but nowadays it's a lot easier to keep a small booklet save than a digital file on a connected machine.
It is strange how people get blinded by technology and forget about oldest, most reliable methods.
I have worked as a security officer at a credit card acquirer (basically, processing credit card transactions between terminal and the bank).
The process to safeguard your PINs is extremely complex but at the very end relies on pieces of paper with passwords and key components written down, put in tamper evident envelopes and then into safes.
Earlier quoted context omitted.
I have couple of ways of dealing with the problem. -- Pen and paper? It is still a thing and cannot be stolen online. -- If you are afraid your family will access it without your knowledge, use tamper evident bag and a notepad to make notes of bag serial numbers. This prevents anybody from accessing it without your knowledge. -- Split the password into components so that even if somebody gets access to the piece of p…
Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.
although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.
The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious.
Why not just remember your passwords? There is an infinite number of strategies and secret rules which you can use to easily remember your passwords.
Or for low-importance services, why not just use your browser's built-in password manager? You have to trust the browser maker anyway.
The best password manager is your own salting algorithm and memory.
You want to back up your comment with some actual convincing arguments that human memory is better than the plethora of tools 1password offers?
I know you won't because although it makes for a nice, witty comment on HN, it's such an absurd thing to actually consider at face value.
Truly random, unique passwords for each website. OTP support and backups. Sharing with audit trails for teams. Encrypted files. The list is long.
That's why I never used and will never use a password manager... You can't get more security by trusting more intermediaries with your passwords. When it comes to anything that matters, you want to trust as few intermediaries as possible. The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious. Why not just remember your passwords? There is…
Highly respected people whose entire careers is security will disagree with you. I'm not telling you to take an argument for authority, but maybe do some introspection about who is more likely to be correct there...
Edit: Parent comment edited out some really outrageous claims, so my reply no longer makes as much sense.
Earlier quoted context omitted.
Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.
You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.
Personally, I use keepassxc + keepass2android + browser plugins + syncthing. The idea of storing my passwords in someone else's cloud gives me the heebie jeebies...