Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to you create and manage passwords?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Ask HN: How to you create and manage passwords?

#51

Post by 3pt14159 »

mixmax wrote: post #5

I take a layered approach. One password for all the stuff that isn't really important like sites I visit a few times and then leave. One password for sites I trust and use on a regular basis, but where a compromised password isn't the end of the world. HN is in this category. Seperate and strong passwords for stuff that matters, like netbanking, gmail, etc. To remember these I have a system set up so that the passwor…

Same here. I've written up my methods here, which are similar in spirit, but not the same in execution.

Basic level password example: "pi975315703" -> alpha-numeric, easy to remember because I have typed it a billion times.

Medium strength: "C0caC0la1s Coca Cola (upper case because it is a company) is not as good as pie always use 0 for o and 1 for i.

High Strength: "9T&11E:ttttttttteeeeeeeeeee+pi975315703" -> all I have to remember is "nine 't's and eleven 'e's plus weak password" but someone trying to hack it with a hash table or whatever would be significantly slowed.

Max strength (where life or my job hangs in the balance): get university text book and ruler, goto page 314 hold ruler along 3rd column of paragraph text, read each letter downwards write on bottom left corner of page in very light pencil "3X5%"

"WdeAdehaeeadyej.dR35Tyismdy+3X&5%:xxx%%%%%+pi97531570" -> I think you should get the idea here.

I'm also super paranoid about key loggers. One of my friends did this to the whole school when I was 16, so ever since then I have never entered high or max on a public computer, just in case. All told I think I have about 35 active passwords that I can easily remember (or obtain in the textbook one).

Re: Ask HN: How to you create and manage passwords?

#53

Post by palish »

3pt14159 wrote: post #51
mixmax wrote: post #5

I take a layered approach. One password for all the stuff that isn't really important like sites I visit a few times and then leave. One password for sites I trust and use on a regular basis, but where a compromised password isn't the end of the world. HN is in this category. Seperate and strong passwords for stuff that matters, like netbanking, gmail, etc. To remember these I have a system set up so that the passwor…

Same here. I've written up my methods here, which are similar in spirit, but not the same in execution. Basic level password example: "pi975315703" -> alpha-numeric, easy to remember because I have typed it a billion times. Medium strength: "C0caC0la1s Coca Cola (upper case because it is a company) is not as good as pie always use 0 for o and 1 for i. High Strength: "9T&11E:ttttttttteeeeeeeeeee+pi975315703" -> all I…

You're too hardcore for me, man. Is a 50+ letter password really worth it? My tiny brain barely remembers the 5 or 6 passwords I always choose to use.

Re: Ask HN: How to you create and manage passwords?

#54

Post by jsteele »

brl wrote: post #44
maneesh wrote: post #4

I use SuperGenPass, which hashes the domain of a website with a Master password, so you only need to remember one password. Then, every time you log in, you just enter in your master password, it automatically hashes it, and you get a new password for logging in like af49AgsdU8 EDIT: here's the link http://www.supergenpass.com/

This scheme is hugely flawed. If you steal a password list from a website you can identify all the passwords generated by this utility (10 characters, uniform distribution over alphanumeric characters) and then simply crack the master passwords with a brute force attack. If you have stolen multiple SuperGenPass generated passwords from the same website, you can crack them all at the same time with no additional penal…

Except that you don't use the full MD5 sum, so it's not a simple matter of brute-forcing it.

Re: Ask HN: How to you create and manage passwords?

#55

Post by brl »

jsteele wrote: post #54
brl wrote: post #44

Earlier quoted context omitted.

This scheme is hugely flawed. If you steal a password list from a website you can identify all the passwords generated by this utility (10 characters, uniform distribution over alphanumeric characters) and then simply crack the master passwords with a brute force attack. If you have stolen multiple SuperGenPass generated passwords from the same website, you can crack them all at the same time with no additional penal…

Except that you don't use the full MD5 sum, so it's not a simple matter of brute-forcing it.

For the default password length of 10 characters they use ~60 bits of MD5 output. That's more than enough information to uniquely identify the master password.

Re: Ask HN: How to you create and manage passwords?

#58

Post by myav »

I like an very simple approach, which allows me to avoid using password managers.

For all accounts which are of little importance to me (in other words, for ones which can be recreated without any problems) I have got the one easy-to-remember password. "foo87b@r" is the good illustration of what I mean. There are two simple words, separated by a number, and one special symbol. It's very easy to commit in your memory, doesn't look easy to brute force.

But what if there is a malefactor which knows your universal password? If so, you are in trouble. He has all the keys to your e-money, mailbox...

To protect things that matters I'm using unique passwords made on basis of the general pattern. It will prevent your accounts from being accessed using the insecure "foo87b@r" pass.

To illustrate that, suppose that our patter is: __&_1_H@ckN!ws (placeholders for further substitutions are marked by "_")

Let's generate password for the [n]ew[s].[y]combinato[r].com site (which characters of url are used when generating password is up to the user).

Here is your secure password: ns&y1rH@ckN!ws

So, to use it you should be able to remember one simple password, one pattern and the princible describing how to get new passwords from the existing pattern + URL.

I've been using this scheme for the last two months.

Re: Ask HN: How to you create and manage passwords?

#59

Post by DenisM »

twopoint718 wrote: post #31

I have a mix of methods. For sites that I rarely visit or are of no real consequence if the password were compromised I use a memorable one for them all. For sites that I care about the security I generate a random password with something like this: dd if=/dev/urandom bs=1 count=12 | uuencode - then store that in psafe ( http://www.hep.wisc.edu/~dan/psafe/ ) with a master password that I remember. This way if some si…

Your command never generates lower-case letters. :-)

Re: Ask HN: How to you create and manage passwords?

#60

Post by mightybyte »

m0sh3g wrote: post #38

clipperz.com FTW They also have community version that you can install on your own server

I have to add another vote for Clipperz (http://clipperz.com). I started using it to manage insecure passwords. I tried to use a generic insecure password as others have mentioned above, but I kept encountering slightly different password restrictions that made this very difficult. I think Clipperz is web-based password management done right. Encryption is done in the browser and the javascript code is open source. Only encrypted data is stored on the server, so they can't even get your information. I highly recommend at least checking it out.
Post reply on HN