Write your passwords down (2010) • Hacker News Board

Re: Write your passwords down (2010)

#11

Post by ethbr0 » Mon, Aug 07, 2023, 1:44 PM UTC

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head.

If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius.

--

And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesses, but also serious strengths... especially in a post ~2005 always-on, networked-everything world.

It turns the security requirement from electronic security into physical security (and appropriate recovery and disposal procedures).

I'm not sure that's a bad trade-off these days. I don't hear about too many people having their password pickpocketed off them...

Full disclosure: Never hopped on the password manager train, because I couldn't find a combination of (a) easy to use multi-device/OS/program, (b) open source, (c) secure from host / corporate ownership. If anyone has recommendations today, would love to revisit...

Re: Write your passwords down (2010)

#12

Post by devnull3 » Mon, Aug 07, 2023, 1:44 PM UTC

Do not write your real password. Instead modify it in certain way which is easy to remember:

E.g real password is "xB6fqmd$a90". Apply algo: swap 2nd and last char. So store it as: "x06fqmd$a9B"

This algo should be easy to remember and there infinite ways to come up with your own algo.

Even if your passwords are exposed there is additional protection.

In other words you have your own simple symetric encryption with algo being the secret.

Re: Write your passwords down (2010)

#13

Post by sigmonsays » Mon, Aug 07, 2023, 1:45 PM UTC

this method fails hard for a couple reasons 1. password changes when previous can't be reused 2. restricted characters in password

Re: Write your passwords down (2010)

#14

Post by Zambyte » Mon, Aug 07, 2023, 1:45 PM UTC

skerit wrote: post #3

gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

Exactly, using phrases is so much nicer and better in every way. It annoys me when sites demand a password should have a special character or upper case letter in it. Or even worse: a max length.

Just use that kind of passphrase for your password manager master password, and let it generate valid passwords for you.

Re: Write your passwords down (2010)

#15

Post by Agent766 » Mon, Aug 07, 2023, 1:45 PM UTC

EdTechAndrew wrote: post #4

Question for security experts: Is this really that much more secure than a local only password manager, like KeePass? It is fun, but the inconvenience of it feels like its not worth the benefits.

I don't think it is. I recommend using a password manager that supports hardware 2fa. One of the main issues with the proposed paper mechanism are that it doesn't support rotating passwords individually. Another is sites that share second and third characters would share a password.

Re: Write your passwords down (2010)

#16

Post by lobsterthief » Mon, Aug 07, 2023, 1:46 PM UTC

EdTechAndrew wrote: post #4

Question for security experts: Is this really that much more secure than a local only password manager, like KeePass? It is fun, but the inconvenience of it feels like its not worth the benefits.

Also, wallets are commonly lost and stolen. And houses burn down and are burglarized.

Unless you plan on keeping your passwords in a fireproof safe, which isn’t exactly convenient—especially in our modern mobile world. In 2010, when this article was written, far fewer people did this much computing from a smartphone.

Re: Write your passwords down (2010)

#17

Post by ethbr0 » Mon, Aug 07, 2023, 1:47 PM UTC

sigmonsays wrote: post #8

amelius wrote: post #5

What if the website doesn't allow the characters that you used in the table? What if there are multiple websites with the same 2nd and 3rd characters?

what if the password needs to be changed and previous ones can't be reused (You then must remember that)?

That's a use case for the good 'ole iterated number!

Eventually you roll off the end of the history check, and can reuse the original on the next iteration.

In my practical experience, I've never had a site where this happens with an account lock on bad password aggressive enough to lock me out before I find the iteration I'm on.

Re: Write your passwords down (2010)

#18

Post by AtNightWeCode » Mon, Aug 07, 2023, 1:47 PM UTC

jug wrote: post #9

skerit wrote: post #3

Earlier quoted context omitted.

Exactly, using phrases is so much nicer and better in every way. It annoys me when sites demand a password should have a special character or upper case letter in it. Or even worse: a max length.

Max lengths are so sketchy because this makes it more likely the crazy guys are actually storing your password rather than the fixed size hash.

Passwords are sent to the server though in most cases. So there must be some limit.

Re: Write your passwords down (2010)

#19

Post by ComplexSystems » Mon, Aug 07, 2023, 1:48 PM UTC

What do you do if some website requires you to change your password for some reason? Of course you could use an alternate method - like reading vertically instead of diagonally for that one website - but now you need to remember how many passwords each site has made you generate.

Re: Write your passwords down (2010)

#20

Post by 0xbadcafebee » Mon, Aug 07, 2023, 1:48 PM UTC

Do not do this. It's just crappy security practice.

Password managers give you versions & history (you need to rotate passwords occasionally), a TOTP generator+seed store, configurable password generator using a schemes of characters (some websites only allow specific characters), is encrypted at rest & in memory so it's more secure than a piece of paper in your wallet, is backed up online, and of course you only have to memorize one master password. (use BitWarden or 1Password, the rest have downsides/limitations)

Besides, as XKCD made popular, long phrases of words are easier to remember than random passwords and contain plenty of entropy.

Also, people aren't "good at securing their wallet". I'm sure as hell not gonna write my bank account password in my wallet and then walk around Barcelona, Athens, Paris or Rome.