Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

networkworld.com

Post reply on HN
Print view View original

11–20 of 96 posts

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#11

Post by veli_joza »

jeremysmyth wrote: post #4

This method fails as soon as you have to change a password: - One of the sites is compromised - One of your devices is stolen/lost and you have to change some passwords - One of the sites has a password expiration policy Pretty soon you end up with multiple password schemes and you're in precisely the same situation as before, wondering which password goes with which site, only this time you have to perform algorithm…

Previously on HN there was a MasterPassword[1] app that solves the issues changing passwords, too short site names as well as doing computation in head.

[1] http://masterpasswordapp.com/

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#13

Post by drinchev »

I try to ignore articles like this and I'm surprised that this was written in 2015. As @jeremysmyth noted this method is flawed.

There's no solution for passwords today, better than the password manager.

People reading this article, should not consider Manuel Blum's idea as use-worthy.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#14

Post by keerthiko »

It's much better to use reasonable_passphrase + "-" (or other special character permitted in most passwords like '.' or ' ' or ',') + site_name.

So "Superdonkey11_amazon" and "Superdonkey11_dropbox" would be strong passwords, where compromising one to a password database leak would only jeopardize other passwords if a human would pick out your password and think about how it applies to other services you use.

If you have to change your password with the site just cycle through a couple root passphrases. You now have salted your password per site in a human-memorizable way without some weird algo ritual to access every password.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#15

Post by raverbashing »

drinchev wrote: post #13

I try to ignore articles like this and I'm surprised that this was written in 2015. As @jeremysmyth noted this method is flawed. There's no solution for passwords today, better than the password manager. People reading this article, should not consider Manuel Blum's idea as use-worthy.

Password managers have a central point of failure, either it's breached or its password/data is lost

I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#16

Post by jalanb »

OrangeTux wrote: post #6
dyates wrote: post #3

And now your password strength is a function of the length of the site's name. Great! EDIT: This seems like much more effort than just using a password manager, or even just a stronger, memorable passphrase or two.

It's probably saver than 'password123' which is the alternative for most people.

Yes, but the kind of people who do use "password123" are going to run a mile from this method as soon as they hear "algorithm"

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#17

Post by sillysaurus3 »

keerthiko wrote: post #14

It's much better to use reasonable_passphrase + "-" (or other special character permitted in most passwords like '.' or ' ' or ',') + site_name. So "Superdonkey11_amazon" and "Superdonkey11_dropbox" would be strong passwords, where compromising one to a password database leak would only jeopardize other passwords if a human would pick out your password and think about how it applies to other services you use. If you…

"Superdonkey11_amazon" and "Superdonkey11_dropbox" would be strong passwords, where compromising one to a password database leak would only jeopardize other passwords if a human would pick out your password and think about how it applies to other services you use.

It's easy to write a script that looks for "dropbox," "Dr0pbox," etc and replaces them with "twitter" and "Tw1tter" respectively.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#18

Post by Beltiras »

jeremysmyth wrote: post #4

This method fails as soon as you have to change a password: - One of the sites is compromised - One of your devices is stolen/lost and you have to change some passwords - One of the sites has a password expiration policy Pretty soon you end up with multiple password schemes and you're in precisely the same situation as before, wondering which password goes with which site, only this time you have to perform algorithm…

Add the idea of a nonce to the scheme and it covers the edge-cases you bring up.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#19

Post by drinchev »

raverbashing wrote: post #15
drinchev wrote: post #13

I try to ignore articles like this and I'm surprised that this was written in 2015. As @jeremysmyth noted this method is flawed. There's no solution for passwords today, better than the password manager. People reading this article, should not consider Manuel Blum's idea as use-worthy.

Password managers have a central point of failure, either it's breached or its password/data is lost I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'

What do you consider as better solution?

> and they're not the 'ultimate solution'

Negative statements have less information than positive ones.

I don't need a backup, because my password manager syncs with my phone and tablet. Loosing those two and my computer simultaneously would put me in really big trouble, but statistically I'm much more secure than transmitting non-truly-random passwords across the Internet.

Post reply on HN