Write your passwords down (2010) • Hacker News Board

Re: Write your passwords down (2010)

#111

Post by Tagbert » Mon, Aug 07, 2023, 4:15 PM UTC

legitster wrote: post #37

Unless you are a high profile target, the risk of someone burglarizing your house without you knowing it and actually making use of a password book is virtually nil. Plus, you should really keep a physical copy of your passwords anyway in case something were to happen to you and your loved ones need access to your accounts, insurance, banking, photos, etc.

When my brother died suddenly, recovering his passwords was a nightmare. Especially for accounts he managed for his wife’s dental business. Fortunately his son and I were able to guess his main password and a few others. We also found that he was reusing a small set of passwords. We finally were able to get into all of the relevant accounts and then wrote everything down and gave it to his wife. Not a fun process. We should all think about what happens after our deaths and how other people will deal with our messes.

Re: Write your passwords down (2010)

#112

Post by Verdex » Mon, Aug 07, 2023, 4:16 PM UTC

jamesponddotco wrote: post #78

gostsamo wrote: post #2

Don't use fancy combinations. Word phrases are even more random and much easier to remember. E.G. "touch-some-grass" is rander longer than any recommended minimum and hardly could be connected to any website.

For anyone looking for a dictionary for diceware passwords (or passphrases, or whatever you call them), I have one available over here[1] with over 23000 words with a minimum of 3 characters. [1] https://git.sr.ht/~jamesponddotco/acopw-go/tree/trunk/item/w...

There also exists a few word lists online in the public domain.

For example, project gutenberg has Moby Word Lists by Grady Ward which is supposedly in the public domain (at least for the USA).

https://www.gutenberg.org/ebooks/3201

https://www.gutenberg.org/files/3201/files/

Last time I looked into it, there were a few different options floating around for word lists.

Re: Write your passwords down (2010)

#113

Post by TedDoesntTalk » Mon, Aug 07, 2023, 4:16 PM UTC

ndriscoll wrote: post #83

AtNightWeCode wrote: post #18

Earlier quoted context omitted.

Passwords are sent to the server though in most cases. So there must be some limit.

The sensible thing to do here is hash the password before sending it, not impose a character limit on the field. Ideally, browsers could even support this directly as part of the input element if they weren't busy adding things no sane person wants like webUSB or browser notifications.

They do support it directly. There has been a WebCrypto API with carrots hashing algorithms for years.

Re: Write your passwords down (2010)

#114

Post by groby_b » Mon, Aug 07, 2023, 4:18 PM UTC

moron4hire wrote: post #51

lobsterthief wrote: post #16

Earlier quoted context omitted.

Also, wallets are commonly lost and stolen. And houses burn down and are burglarized. Unless you plan on keeping your passwords in a fireproof safe, which isn’t exactly convenient—especially in our modern mobile world. In 2010, when this article was written, far fewer people did this much computing from a smartphone.

Times in the last 40 years that... My wallet has been stolen: 0 My house has burned down: 0 LastPass has been breached: 2+ LastPass' browser extension has caused me headaches: 9000+

The problem here might be LastPass, not password managers.

Re: Write your passwords down (2010)

#115

Post by remram » Mon, Aug 07, 2023, 4:25 PM UTC

ethbr0 wrote: post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

The problems I see with this:

* Websites will be hacked or expire your password, so you will have to generate a new one. Even assuming you have a way to make a new password for the same site name, how do you keep track of which version number you are now?

* Website names are not evenly distributed, especially if taking the first two letters. Example: twitter/twitch.tv/twilio would all share a password

Re: Write your passwords down (2010)

#116

Post by jmcphers » Mon, Aug 07, 2023, 4:25 PM UTC

ethbr0 wrote: post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

I like pass, the "Unix standard password manager": https://www.passwordstore.org/

It is very barebones -- basically a collection of GPG encrypted text files stored in Git. For that reason it's trivial to make clients for it and selfhost the repository if you're so inclined.

Re: Write your passwords down (2010)

#117

Post by remram » Mon, Aug 07, 2023, 4:27 PM UTC

IggleSniggle wrote: post #44

Obscurity4340 wrote: post #26

Earlier quoted context omitted.

Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves. Obviously there's other choices for those who want more control over it but you can't go wrong with BW.

Notably, Bitwarden is also self-hostable, which, in combination with the good mobile clients, was enough to get me to switch to it from Keepass.

Vaultwarden is even easier to self-host, it's basically a single binary that uses a SQLite database: https://github.com/dani-garcia/vaultwarden

Re: Write your passwords down (2010)

#118

Post by JohnFen » Mon, Aug 07, 2023, 4:35 PM UTC

ethbr0 wrote: post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

> It turns the security requirement from electronic security into physical security (and appropriate recovery and disposal procedures)

Good physical security of things like passwords is generally much easier than electronic security of them.

In the old days, my password manager was a slip of paper I kept in my wallet that listed my passwords. I kept duplicates at home and in my safe deposit box.

Now I pretty much do the same thing, except using an (offline) password manager instead of paper.

Re: Write your passwords down (2010)

#119

Post by syllablehq » Mon, Aug 07, 2023, 4:37 PM UTC

It makes me so sad that it's 2023 and we haven't fixed passwords. There's no need for any of this. Your email account (+ multi-factor as desired) will always be the weak link, so just reduce everything to that. Get rid of passwords.

Create a new standard that falls back to passwords to work with legacy systems, but going forward will enable a password keepers to just authenticate you with a generated random password saved encrypted to your cookies that the user never even has to see. Then reset it as needed through your email (+ multi-factor as desired) as needed.

User-visible passwords should die. Technologists should to get un-stuck from living in the current password paradigm. I've been wanting to make this rant a blog post but haven't gotten around to it - esp because I know it's been written about a million times already.

Re: Write your passwords down (2010)

#120

Post by JohnFen » Mon, Aug 07, 2023, 4:39 PM UTC

Tagbert wrote: post #111

legitster wrote: post #37

Unless you are a high profile target, the risk of someone burglarizing your house without you knowing it and actually making use of a password book is virtually nil. Plus, you should really keep a physical copy of your passwords anyway in case something were to happen to you and your loved ones need access to your accounts, insurance, banking, photos, etc.

When my brother died suddenly, recovering his passwords was a nightmare. Especially for accounts he managed for his wife’s dental business. Fortunately his son and I were able to guess his main password and a few others. We also found that he was reusing a small set of passwords. We finally were able to get into all of the relevant accounts and then wrote everything down and gave it to his wife. Not a fun process. We…

> We should all think about what happens after our deaths and how other people will deal with our messes.

I have a package prepared for after my death that includes the master password for my password manager, just for this reason. The rest of my passwords can be obtained from the password manager.

It also contains a list of all important accounts I have and official copies of important documents. And a description of my various servers and what they do. And a personal letter to my loved ones.