I don't believe in these sorts of database-free password management systems. These require users to remember too much stuff and are not flexible to be used universally. And using these gets only more painful over time as exceptions etc accumulate. These issues have been discussed fairly comprehensively in the various HN threads on hash-based password managers, which share most if not all the downsides with this particular project.
A plastic card for easy to remember strong passwords
31–40 of 110 posts
Re: A plastic card for easy to remember strong passwords
#32I have just as hard a time remembering my usernames as I do passwords.
Re: A plastic card for easy to remember strong passwords
#33Cool solution for folks like us. Best way to diminish password as an attack vector and secure services for the thronged masses is to reduce the number of passwords required to use the Internet. And couple a master (eg My google account) account with a second, biometric factor.
Re: A plastic card for easy to remember strong passwords
#34That's all well and good until you lose it or run it through the washing machine. Then your entire password system is gone. Any backup would need to be stored in a place that might as well be your 1Password/LastPass database.
Re: A plastic card for easy to remember strong passwords
#35This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…
It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was gen…
> But the assumption of password usage is that the password itself is never stored...
That's a bold assumption.
Re: A plastic card for easy to remember strong passwords
#36Earlier quoted context omitted.
https://github.com/resonantcore/lib/blob/master/js/diceware/... https://github.com/resonantcore/lib/blob/master/demo/dicewar... Run this locally, e.g. dw = new Diceware(); dw.load("https://raw.githubusercontent.com/resonantcore/lib/master/js/diceware/diceware.wordlist.asc", function() { console.log("Diceware loaded!"); }); console.log(dw.getWords(8).join(' '));
If you're on linux you can usually just do: shuf -n 5 /usr/share/dict/words On Mac OS X you need coreutils for shuf, which you can get from brew (it's called gshuf once installed).
To get rid of the newlines
shuf -n 4 /usr/share/dict/words | xargs | sed 's/ //g'Re: A plastic card for easy to remember strong passwords
#37Earlier quoted context omitted.
This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Much like many results in computational complexity, worst-case results are not necessarily indicative of real-world utility. To wit, in the scenario you outlined the attacker must a) know beforehand that the target was using this device; b) know beforehand that the inserted middle portion was vulnerable to…
> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized i…
yea a coworker uses YubiKey... it generates extremely strong one-time-use passwords (essentially just meaning it auto-generates a different one for every site?) & auto-enters them through a browser add-on when the device is in USB (I believe?)
seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only leaves you vulnerable to people who have physical access to the USB device, and even then i can imagine simple ways to make even that a hassle (have another password layer as master sign-in? would be enough to deter most of your acquaintances from being able to use your device)
Re: A plastic card for easy to remember strong passwords
#38This is a lot like PasswordCard[0] except not free. [0] https://www.passwordcard.org/en I think I'd like PasswordCard because it's pretty freeform - just pick a starting point and a visual direction/pattern and copy letters from the card. But honestly I don't much like the idea of relying on a physical token if I don't need to. Almost losing my 2FA last year was a bit scary.
PasswordCard does give you a seed number to generate the same card, though..
Re: A plastic card for easy to remember strong passwords
#39Who has access to the "random" info on those cards? How randomly are they generated? If you bought a few of them, could you work backwards to the generation algorithm?
Re: A plastic card for easy to remember strong passwords
#40What prevents me from using this type of strategy is the inconsistent adoption of password requirements. For example, some of the websites I use require passwords to contain at least one capital letter, or a digit, or a punctuation mark (e.g. ! ? #, etc.). But other Website do not allow punctuation marks or digits. Some require a password of a minimum length, but a dwindling few can only accept fairly short maximum l…
Wait really? It feels like almost every time I make a new account somewhere and drop in the 200 character high-entropy password that LastPass generated, I get a silent failure or misleading error message about "your username was not recognized." Then I try guessing which feature of my candidate password is pissing off the site: Is it the whitespaces? Special characters? Length?
This is particularly maddening because there are plenty of ways to accept arbitrary passphrases from users.