181–190 of 196 posts
Earlier quoted context omitted.
Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves. Obviously there's other choices for those who want more control over it but you can't go wrong with BW.
2FA in the same app as your password defeats the point doesn't it?
Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…
Spectre does that, is OSS and multiplatform: https://spectre.app/ i.e. it generates password given your name, a master password, and the website hostname (or whatever). Quite handy.
I'm using an algorithmically generated password. It's long, secure, and I need not remember it. I use random batter-horse-staple-whatever passwords (my own variety of casing and spacing) only in the most important things, like bank or government account and I write them down.
That's insecure because if the password leaks from any site it could be trivially used by attacker in other sites. And your algorithm is not safe at all because password crackers could guess your algo and generate millions of its variations.
echo QGiruyN3DCTTUN/OoRdP9WDJh+E amazon|md5sum
produces 7c7a50469cf6c97d541956ad06ae0add
echo QGiruyN3DCTTUN/OoRdP9WDJh+E facebook|md5sum
produces f6bf0d9e5d5b94e095355f4902232084
Feel free to guess the QGiruyN3DCTTUN/OoRdP9WDJh+E part from the output.
Unless you are a high profile target, the risk of someone burglarizing your house without you knowing it and actually making use of a password book is virtually nil. Plus, you should really keep a physical copy of your passwords anyway in case something were to happen to you and your loved ones need access to your accounts, insurance, banking, photos, etc.
When my brother died suddenly, recovering his passwords was a nightmare. Especially for accounts he managed for his wife’s dental business. Fortunately his son and I were able to guess his main password and a few others. We also found that he was reusing a small set of passwords. We finally were able to get into all of the relevant accounts and then wrote everything down and gave it to his wife. Not a fun process. We…
The solution is you give third parties access to your vault, but it's on a time lock. To see what's in the vault they first have to request access. You will be notified if they do, and access is only granted after a delay and during that delay you can block them.
I'm using an algorithmically generated password. It's long, secure, and I need not remember it. I use random batter-horse-staple-whatever passwords (my own variety of casing and spacing) only in the most important things, like bank or government account and I write them down.
That's insecure because if the password leaks from any site it could be trivially used by attacker in other sites. And your algorithm is not safe at all because password crackers could guess your algo and generate millions of its variations.
Algorithmically generated passwords for different sites was a mind-blower. There are so many differentiation algorithms that are trivially runnable in your head. If most sites are salting and hashing passwords correctly (this is 2023...), then that drastically decreases your compromised credential blast radius. -- And it makes me sad that "store your passwords on dead-tree paper" became GOTO. It has serious weaknesse…
I like pass, the "Unix standard password manager": https://www.passwordstore.org/ It is very barebones -- basically a collection of GPG encrypted text files stored in Git. For that reason it's trivial to make clients for it and selfhost the repository if you're so inclined.
Earlier quoted context omitted.
2FA in the same app as your password defeats the point doesn't it?
It’s not my preferred method because I want 2FA to save me if my device is compromised, but it does still add protection against traditional password attacks, credential stuffing, etc. It even adds a layer of phishing resistance, as long as the user doesn’t blindly jump to copy/paste when autofill fails.
Earlier quoted context omitted.
I really do bot understand the policy of github. Before I could have a 40 char password in my head. Now it MUST be somewhere in my disc. I was totally surprised as I learned is the only way to login. Seems a 50 year old idea
And yet the likelihood of you telling someone or typing the contents of this file somewhere you shouldn't is much lower. It's more phishing resistant and is much less likely to be in some leaked password database, that's what GitHub cares about. Targeted attacks on single people don't even move the needle. Phishing and password stuffing attacks are like 95% of 'hacking' attempts. And frankly it is very likely that yo…
I don't think I ever cringe as much as HN threads with people clamoring for backwards steps for security.
Earlier quoted context omitted.
For better and worse that is basically what Passkeys are trying to do. Using public key cryptography is a little more complicated than (symmetrically) encrypted cookies, but not by much. (And is overall harder to easily exfiltrate so works for more threat models.)
Interesting, I hadn't followed this in a while, and it does sound like this is getting closer to an open standard... But it sounds like the discussion of it gets mixed up with other muck including biometric, 2-factor, proprietary tools, TOTP auth etc. Seems we need a first step that ONLY focuses on abstracting the password away and still letting email be a natural reset. Seems to me that the standard should simply al…
I'd literally get dozens of emails a day. Absolutely not. Passkeys are the solution. Literally everyone whining and complaining and imagining up ideas in this thread ... It's webauthn and passkeys and can we stop wasting our keystrokes over it.
Earlier quoted context omitted.
Also, wallets are commonly lost and stolen. And houses burn down and are burglarized. Unless you plan on keeping your passwords in a fireproof safe, which isn’t exactly convenient—especially in our modern mobile world. In 2010, when this article was written, far fewer people did this much computing from a smartphone.
Times in the last 40 years that... My wallet has been stolen: 0 My house has burned down: 0 LastPass has been breached: 2+ LastPass' browser extension has caused me headaches: 9000+
The number of times gpg has failed to decrypt one of my "pass" entries: 0.