Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does anyone use an alternative to a password manager?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 250 posts

Re: Ask HN: Does anyone use an alternative to a password manager?

#141

Post by SeanLockItUp »

rockostrich wrote: post #118
Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to and even realize that your password has some sort of generation algorithm, but it would be a bit more secure to hash that password in some way. That's why I like using LessPass (even though people talk a bit of shit about it whenever it's mentioned on HackerNe…

> Doesn't this compromise all of your passwords if one of your passwords is discovered?

I've been trying to understand password managers for a while. My workplace forces us to use one.

But what you've said doesn't make sense. If your "master password" used in the password manager is discovered, then all your passwords are compromised.

If my laptop or phone gets stolen and someone knows the password from my password manager, then I'm done for.

I choose to follow the algorithm approach too. Even though it's BS.

Re: Ask HN: Does anyone use an alternative to a password manager?

#143

Post by falcolas »

nicky0 wrote: post #117
exhilaration wrote: post #112

Earlier quoted context omitted.

I've been happily using 1Password 4 for many years, my credentials are encrypted and synced via Dropbox. But I hear the latest versions require you to use their cloud service, the self-hosted version is no longer available. Is that true? I use 1Password for not only credentials but as a document vault for everything from passports, birth certificates, anything else that falls under "needed after the house burns down"…

Whilst they do have a cloud-hosted subscription service, the self hosted version is still available.

And self-hosted can put the files in Apple's iCloud service, making it accessible on your phone. At least, that's how my own is still working.

Re: Ask HN: Does anyone use an alternative to a password manager?

#144

Post by DerfNet »

madjam002 wrote: post #142

For me, https://www.passwordstore.org/ and a Yubikey is the best setup I've tried. It's quite a lot of work to set it up though.

So, how does this work on a smart device? Do you plug the Yubikey into an OTG, or do you just not access anything on your phone?

Re: Ask HN: Does anyone use an alternative to a password manager?

#145

Post by ryan-c »

Kequc wrote: post #134
ryan-c wrote: post #127

Earlier quoted context omitted.

If someone suspects such a solution is being used, they can attempt to crack the master password. Combined with the weakness of this not supporting forced password rotation or varying complexity requirements well, it's really not a good solution.

Why would anyone suspect that? You're talking about what 1 in several million users? All you have to be is above the threshold of "easy to hack". I'd like to be referred to such a thing if there is one already.

The specific tool mentioned uses a trivial scheme. If I were trying to crack a large breach, I'd probably try running a few billion master passwords with that algorithm.

Re: Ask HN: Does anyone use an alternative to a password manager?

#146

Post by h4waii »

ProblemFactory wrote: post #84
Waterluvian wrote: post #78

I use an algorithm. In short: 1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to. Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email. It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution tha…

The Algorithm is a great solution - breaking the pattern would require password leaks from 3-4 different sites, and a human to spend time puzzling over it. For automated bots the passwords look unique. What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you…

Ehh. Any password cracker worth their salt would be able to use rules to break hashes created by "The Algorithm", especially easier once the base word has been figured out or supplied by a single plain-text leak.

Re: Ask HN: Does anyone use an alternative to a password manager?

#147

Post by madjam002 »

scoates wrote: post #90
danicgross wrote: post #21

We really need passchange.js: an open source collection of headless JS scripts that can programmatically change your password on a given website. Then you would continuously rotate _all_ your managed passwords as well as your master. Not a panacea, but significantly minimizes the length of a theoretical breach.

I have been working on-and-(mostly-)off on something like this for a while: https://github.com/scoates/celobox Wish I had more time to spend on it.

This is a fantastic idea, just a simple config file which describes how to change a password for a site, which different programs can then interpret differently.

Re: Ask HN: Does anyone use an alternative to a password manager?

#148

Post by thinkMOAR »

DerfNet wrote: post #144
madjam002 wrote: post #142

For me, https://www.passwordstore.org/ and a Yubikey is the best setup I've tried. It's quite a lot of work to set it up though.

So, how does this work on a smart device? Do you plug the Yubikey into an OTG, or do you just not access anything on your phone?

Typically you can load the key (from the ubikey) into google authenticator too on your phone

Re: Ask HN: Does anyone use an alternative to a password manager?

#149

Post by [deleted] »

DerfNet wrote: post #144
madjam002 wrote: post #142

For me, https://www.passwordstore.org/ and a Yubikey is the best setup I've tried. It's quite a lot of work to set it up though.

So, how does this work on a smart device? Do you plug the Yubikey into an OTG, or do you just not access anything on your phone?

[deleted]

Re: Ask HN: Does anyone use an alternative to a password manager?

#150

Post by chrisper »

NoGravitas wrote: post #85

I'm a bit surprised at all of the people suggesting "remember one password, and mutate it with an algorithm based on the website name". That means that if you have to invalidate one password for any reason, you have to change all of them. On every service that you use. Do people really do this?

Yes. There are some passwords that I have to remember since putting them into a password manager is not possible.
Post reply on HN