131–140 of 185 posts
This won't work very well if the site you're logging into uses bcrypt, and the value you store in your password manager is >= 72 characters. https://paragonie.com/blog/2016/02/how-safely-store-password...
If a site is using bcrypt and it allows users to set passwords longer than 72 chars, the operator of the site is the problem not the use of a password manager + in-my-head-secret
> use a horcrux only for the most important logins - your social media, bank accounts etc. Am I the only person who does a huge double take on this? If someone hacks a facebook or a twitter - what precisely am I scared of? My bank accounts are literally my net worth. If they get hacked I'm broke. Why would I want a particularly strong password on Twitter or Facebook or Linkedin for that matter
> use a horcrux only for the most important logins - your social media, bank accounts etc. Am I the only person who does a huge double take on this? If someone hacks a facebook or a twitter - what precisely am I scared of? My bank accounts are literally my net worth. If they get hacked I'm broke. Why would I want a particularly strong password on Twitter or Facebook or Linkedin for that matter
And I'll echo another comment that if you login with Facebook or Google, that increases the value of that password.
On a similar note, your very strongest password should be whatever controls the email where your password resets get sent to.
Even if I could find out which banks don't make this particular offering to Satan, what would prevent the bank I switch to from adopting this malfeasance next week?
Earlier quoted context omitted.
If only we had a secure place to store all of the horcrux strings that are unique per-website! Joking aside, I don't see the point of this. It guards against exactly one attack (your password manager somehow revealing all your passwords) which is unlikely, but not against a whole lot of other (slightly more generic malware, phishing, ...) whilst making logging in harder (there's now a manual process). If you're willi…
That might be likely if the password manager database is stored in the cloud. iCloud hacks seem to be at least somewhat common and iOS users often hsve no other means of syncing their password manager database.
I wrote a program to generate passwords based on user input about 10 years ago. I still use it today and a few teams I have worked with still use it. I called it DPG. Deterministic Password Generator. It is a similar concept. I have implemented it in Go, C++, Java and Python. I wish the idea of generating passwords when needed rather than storing and retrieving them was more popular. Traditional password Managers are…
Why?
Password generators have flaws of their own and have been discussed extensively on hn eg. https://news.ycombinator.com/item?id=13016132 or https://news.ycombinator.com/item?id=22580719
For a small number of key accounts, sure.
Earlier quoted context omitted.
I had one of the most valuable accounts in a video game, so attackers of all kinds were constantly contacting me. I was immediately suspicious of anyone who contacted me. I signed up for the forum with a password from my password manager (I like toying with attackers). I told him I signed up, and a few minutes later he said there was a problem with my account and asked if I used a password manager. I said yes. He sai…
All security eventually relies on obscurity, it's a bad idea to disclose your security practices. Use hunter2 as password for junk sites.
I also agree somewhat about obscurity. Notice that I haven't said what password manager I use, or where I store it. The fact that I use a password manager I don't consider sensitive though.
Earlier quoted context omitted.
Can you elaborate on why all security will eventually rely on obscurity?
It's jokingly called Fleming's cryptanalysis: if there's a secret key, you just send James Bond to steal it.