Ask HN: What is your password management solution?

Post by 6ak74rfy » Sat, Jul 15, 2017, 4:02 PM UTC

dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

Post by linopolus » Sat, Jul 15, 2017, 4:03 PM UTC

Post by dheera » Sat, Jul 15, 2017, 4:03 PM UTC

afshin wrote: post #96

dheera wrote: post #55

This is my password manager. password = b64encode(hashlib.pbkdf2_hmac( 'sha256', (master_password + '/' + domain).encode(), b'', 100000 + n )).decode()[0:16] + 'Aa$1' master_password = some master password that you never write or store anywhere domain = domain name for the service in question, e.g. 'facebook.com' n = the nth password being generated for the domain (typically 0) The 'Aa$1' is to ensure satisfaction of…

One problem I had when using a similar technique is how to change passwords. Some services require regular password changes, security breaches require it, etc. So I needed some additional piece of information, namely how many times I've had to change passwords, so a new function argument. Eventually I gave up and started using a password manager.

Post by tuxxy » Sat, Jul 15, 2017, 4:04 PM UTC

raamdev wrote: post #31

benjaminjosephw wrote: post #13

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/

+1 for `pass`. I wrote a handy Bash script [1] that lets me easily search my passwords without having an exact match (e.g., `fpass fin cap one` quickly finds my password info for "Financial/CapitalOne.gpg"). It makes pulling up passwords so much easier as I only need to remember fragments of how I stored it instead of trying to remember exact folders and names using auto-complete to find the password. I also use iTer…

Post by [deleted] » Sat, Jul 15, 2017, 4:05 PM UTC

tuxxy wrote: post #108

weinzierl wrote: post #90

Earlier quoted context omitted.

I don't question your memory, that is not my point. How long do you think it takes to crack a password that consists of digits of Pi or anything derived from it? And it's not about Pi either, it's just that you can't beat a computer in that regard. For me, playing around with hashcat, was an eye opening experience and I truly believe in the Schneier quote from above.

I agree with Schneier's quote, but you're also forgetting about password hashing. If it takes 10 seconds to derive the key (assuming the use of a strong hash function), anything with a good enough amount of entropy (60-90 bits) should be fine. When an attacker acquires a leaked database, they're not cracking high entropic passwords.