Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Write your passwords down (2010)

blog.jgc.org

Post reply on HN
Print view View original

161–170 of 196 posts

Re: Write your passwords down (2010)

#161

Post by zlg_codes »

Terr_ wrote: post #157
zlg_codes wrote: post #155

Earlier quoted context omitted.

How does your model account for the lack of trustworthiness of the establishment wrt citizen privacy? What guarantee do we have that the bank won't just yeet your lockbox? I'm not sure trusting social institutions is a good idea. History shows it will be used against you, before you die.

You could encrypt the Stash of Secrets given to the legal-firm, with not-so-secret key known only to potential recipients. (Who you trust not to conspire with the firm prior to your death, etc.) However in a way that's just another form of option #2, where different parts must be brought together.

Ah, I hadn't thought of pulling a two-layer version of that... clever, and you can share keys only with people who are in the will or testament. I wonder if law firms or banks feel more safe holding onto things for people if they don't know their contents. I imagine it would reduce liability.

Re: Write your passwords down (2010)

#162

Post by dangitnotagain »

ethbr0 wrote: post #11

Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…

Passwordsafe/password Gorilla(Apple)

It’s been around for ages, I don’t know how well supported today, though it is what you asked for!

Re: Write your passwords down (2010)

#163

Post by normalaccess »

bigmofo wrote: post #105

This looks to be the same as https://www.grc.com/offthegrid.htm (pointed to by normal access). I am not sure how this works, when say in the example one's example.com password has been breached and example.com is forcing one to rotate the password. Then it looks like one has to have two sheets. One for all current passwords and a second sheet just for example.com. Am I missing something? (Does one rotate all of one's…

The solution to this is to add a incrementing number to the domain on a separate list in some fashion. So for example instead of website.com you would use website.com0. If there is a need to generate an new password for the same site you increment the number (website.com1). Since the fist stage of the Off The Grid system is very much like a hash you will end up with a completely different password.

If you want to be REALLY secure about the process to protect from someone finding your grid and list you could run the process twice. Once to create a "hash" of the the domain name then again to generate the password. Sense this is a one way function no one would have a clue what sites you are using.

Domain: website.com > Hash of name: Ght5Fr2\-0 (this is where you append the number) > Password: kHu8HBe#

Steve gives the full breakdown of the process here: https://www.grc.com/otg/goals.htm

I hope this makes sense.

Re: Write your passwords down (2010)

#164

Post by cjcampbell »

flangola7 wrote: post #151
Obscurity4340 wrote: post #26

Earlier quoted context omitted.

Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves. Obviously there's other choices for those who want more control over it but you can't go wrong with BW.

2FA in the same app as your password defeats the point doesn't it?

It’s not my preferred method because I want 2FA to save me if my device is compromised, but it does still add protection against traditional password attacks, credential stuffing, etc. It even adds a layer of phishing resistance, as long as the user doesn’t blindly jump to copy/paste when autofill fails.

Re: Write your passwords down (2010)

#165

Post by syllablehq »

Longhanks wrote: post #123
syllablehq wrote: post #119

It makes me so sad that it's 2023 and we haven't fixed passwords. There's no need for any of this. Your email account (+ multi-factor as desired) will always be the weak link, so just reduce everything to that. Get rid of passwords. Create a new standard that falls back to passwords to work with legacy systems, but going forward will enable a password keepers to just authenticate you with a generated random password…

I absolutely despise everything in this comment. I have a user name and I know the associated password, let me in. Leave me alone with your proprietary authenticators that will lock me out the moment I lose my phone or Google/MS just _decide_ they feel like locking me out. GitHub force-disabling password authentication for git push has actively made me contribute less to GitHub-hosted projects. And when I really feel…

I understand where you're coming from, and if you really want to have a username and password - yes, you should be let in. You should always be able to manually authenticate if you really want to. But I'm arguing that's it's time to automate and hide that process from the user experience. (multi-factor auth is another topic... let's put that aside for now..)

But the reality is that memorizable passwords simply does not scale in any world where we have to authenticate with so many services. It's time to shift paradigms. When you take a step back, it's clear that we're trying to shim a new password keeper system into an old password input field paradigm, and it makes no sense and it's holding us back.

Agreed that no one should be forcing a proprietary authenticator service on anyone. On the contrary, to avoid that, we need an open standard that is cross-compatible between proprietary services.

The open standard should make it easy for any browser, password keeper, multi-factor auth system etc to speak the same language and "just work" instead of hacking around with auto-filling password input fields for no reason. We're so stuck in an old way of thinking that we can't see that the password input field is vestigial and is only making everyone's experience worse.

Re: Write your passwords down (2010)

#166

Post by mongol »

zlg_codes wrote: post #160
mongol wrote: post #75

Earlier quoted context omitted.

I remember a colleague telling me about this, he used one late 2007. I thought "what unneccessary complexity, I store them encrypted with vim, much better". I know better now.

What do you find better about a password manager compared to having total control and storing the passwords yourself in a simple text file? You still need a master password to access the information, and while there's less automation, there is a degree of simplicity and accessibility that is only paralleled by a built-in OS primitive for it. GPG and Vim are on just about everything. I would like to read write-ups of…

I was naive about vims encryption. I did not realize that an encryption key is not the same as a password. It is much more feasible to brute force vim's encryption than to brute force a login for example. And if I am not mistaken the feature has been removed from vim now.

Re: Write your passwords down (2010)

#167

Post by syllablehq »

WorldMaker wrote: post #131
syllablehq wrote: post #119

It makes me so sad that it's 2023 and we haven't fixed passwords. There's no need for any of this. Your email account (+ multi-factor as desired) will always be the weak link, so just reduce everything to that. Get rid of passwords. Create a new standard that falls back to passwords to work with legacy systems, but going forward will enable a password keepers to just authenticate you with a generated random password…

For better and worse that is basically what Passkeys are trying to do. Using public key cryptography is a little more complicated than (symmetrically) encrypted cookies, but not by much. (And is overall harder to easily exfiltrate so works for more threat models.)

Interesting, I hadn't followed this in a while, and it does sound like this is getting closer to an open standard...

But it sounds like the discussion of it gets mixed up with other muck including biometric, 2-factor, proprietary tools, TOTP auth etc.

Seems we need a first step that ONLY focuses on abstracting the password away and still letting email be a natural reset.

Seems to me that the standard should simply allow someone to delegate their "passkey keeper" of choice to be the authentication engine that tracks tokens. It can be up to the user (up to their passkey tool) to decide everything else. But set up a system that let's us log in without a password, and without a proprietary auth system like google or facebook etc.

https://arstechnica.com/information-technology/2022/05/how-a...

Re: Write your passwords down (2010)

#168

Post by kadoban »

rkangel wrote: post #89
kadoban wrote: post #85

Earlier quoted context omitted.

I noticed that as well, the fix for me is pretty easy: just create the account in bitwarder first and then autofill it in the actual account creation page. No extra work, and becomes habit quite quickly.

This is fine on desktop. It's less great on mobile.

I do the same on mobile, not sure I noticed any reason it's worse there.

Re: Write your passwords down (2010)

#169

Post by 0xbadcafebee »

_Algernon_ wrote: post #148
0xbadcafebee wrote: post #135

Earlier quoted context omitted.

Regardless of the threat model, a password manager is better, period. It addresses more threats, provides better security, is more reliable. > your passwords can is safe from malware, digital exploits and so on No they're not. They can still be compromised by malware and digital exploits when you type them into your device. If you have malware you're largely just fucked. That's why people have been trying to get rid…

>No they're not. They can still be compromised by malware and digital exploits when you type them into your device. If you have malware you're largely just fucked. That's why people have been trying to get rid of passwords forever, because they still are vulnerable to a number of attacks in various circumstances. With the notebook you have a single password compromised which has the chance of serving as a canary to d…

> With the notebook you have a single password compromised which has the chance of serving as a canary to detect the compromise.

This sentence makes no sense. There is no canary with a password compromise. Either the site compromised announces the compromise, or a security researcher finds a new list for sale on the dark web and announces it, or nobody knows about it. The password generation/storage method does not matter.

But you definitely will have a huge pain in the ass to figure out alternate passwords for sites when they do get compromised and need to be rotated. Obviously you can't replace this sheet or you'd be resetting all 268 or whatever passwords you currently use.

> With a password manager potentially every password is instantly compromised.

Sure, but the same is true of this weird password map on paper thing. Any "algorithm" most people could actually use to "decode" passwords on that map can be trivially defeated by an amateur. That's why we stopped using paper ciphers like 150 years ago.

> I'm talking about using passwords that eg. are a combination of a notebook part, and a secret only you know, thereby having a unique password for each service

Or you could use a password manager, and just have unique passwords and no memorization.

> If you have to pay attention to security researches to use a package manager it is already impractical for the wast portion of the population.

It's not impractical at all, just use BitWarden or 1Password. This isn't rocket science dude. Just do what security expert tell you to do. (Hint: NONE of them suggest writing passwords down)

> Remembering 239 secure passwords, even with a mnemonic is a fulltime job. It's not in any way realistic.

So. Use. A. Password. Manager.

Re: Write your passwords down (2010)

#170

Post by bigmofo »

normalaccess wrote: post #163
bigmofo wrote: post #105

This looks to be the same as https://www.grc.com/offthegrid.htm (pointed to by normal access). I am not sure how this works, when say in the example one's example.com password has been breached and example.com is forcing one to rotate the password. Then it looks like one has to have two sheets. One for all current passwords and a second sheet just for example.com. Am I missing something? (Does one rotate all of one's…

The solution to this is to add a incrementing number to the domain on a separate list in some fashion. So for example instead of website.com you would use website.com0. If there is a need to generate an new password for the same site you increment the number (website.com1). Since the fist stage of the Off The Grid system is very much like a hash you will end up with a completely different password. If you want to be…

I thought of that (adding a number) when posting, but then one has to remember that number...
Post reply on HN