Live data from Hacker News

Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

networkworld.com

41–50 of 96 posts

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#41
post #27

Why not use a base64 encoded sha1 hash of your password salted with the web address like this: #!/bin/sh #usage: webpass.sh website=$1 stty -echo read -p "Password: " password echo stty echo echo -n "$website" | openssl sha1 -hmac "$password" | cut -d" " -f2 | xxd -r -p | base64 | tr -d -c "[:alnum:]" echo At least this is somewhat cryptographically secure.

I use this public javascript: http://venge.net/programs/twonz.html.

To deal with changed passwords and password restrictions, I use a page with of mapping for each issue to an updated base url or changes to be applied to the forged password.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#45

Earlier quoted context omitted.

Hmm, did I use "hacker news" or did I use "ycombinator" or did I use "news.ycombinator" or....? You have to be specific when you pick the algorithm if it's to work the way the author suggests, and preferably something that is not easily shifted, such as the domain name and not the site's title.

As someone who has used passwords based on the website names for a long time, this has been an issue maybe 3 times, in total.

How long is "a long time"? Because over the year or so I gave sitename-passwords a try it popped up as an issue way more than 3 times, even after I started ignoring subdomains and instituted rules about always trying to use the main domain for big companies. There are tons of systems out there that use cross-domain (notably both of my banks and both of my schools), hidden-domain (i.e. log into an app or device where the parent domain isn't immediately obvious), or changing domains. Of course, these issues were nothing compared to trying to remember all of the variations I added to sate the enormous variety of conflicting password requirements (especially novelty requirements and passwords you don't get to choose).

I was in complete denial about how bad the situation was until I encountered some light teasing from acquaintances who didn't even know me that well -- just well enough to know I couldn't ever remember my passwords. I started keeping tick marks on my calendar and found a ~75% success rate, although the 75% was composed of the handful of logins I used every day and the 25% was "everything else" so the reality was that the password derivation system was failing for a strong majority of passwords.

I gave up and started using lastpass. No regrets, but many positive surprises: that time their network was breached but it didn't matter because they didn't use shit encryption, the automated password reset feature for big-profile leaks (they give you a "todo" list which is often as simple as clicking a single button next to each item), the ability to easily store serial numbers, "verification questions", and other nonsense, a general lack of guessing passwords several times before success, and an ability to dramatically up the cross-entropy of my passwords.

I might move from lastpass to a physical repository some time. But I am never, ever going back to a password derivation scheme.

I wish you luck. Or an eidetic memory. You'll need it.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#46
post #37
post #27

Why not use a base64 encoded sha1 hash of your password salted with the web address like this: #!/bin/sh #usage: webpass.sh website=$1 stty -echo read -p "Password: " password echo stty echo echo -n "$website" | openssl sha1 -hmac "$password" | cut -d" " -f2 | xxd -r -p | base64 | tr -d -c "[:alnum:]" echo At least this is somewhat cryptographically secure.

This suffers from the same problem as the article's algorithm: it is fine until you need to change one of your passwords. Say a site gets compromised, or for whatever reason you need to change your password. Now what? You need to change all your passwords in order to be able to use this method, or you need to remember one different password, or remember that you need to do .2 or something. Either way, you're back to…

> it is fine until you need to change one of your passwords

For me, this happens less often than once a year. And then it is a good idea to change all passwords anyway.

The alternative is to store passwords somewhere in a password manager. However if this storage gets somehow lost/compromised ALL of your passwords get lost/compromised.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#47
post #36

Earlier quoted context omitted.

Password managers have a central point of failure, either it's breached or its password/data is lost I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'

They are probably not the "ultimate solution", but anything that starts with "You'll need to practice ahead of time..." is not even worth considering.

I can't think of a reason to agree with this. Would you like to provide some?

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#48
post #35
post #34

1Password It replaced all my alternatives and I don't have to think anymore about passwords. It saved me a lot overseas and doing a new fresh install in my computers is not painful anymore.

I like it as well, the only problem is when I'm using someone else's computer, e.g. to check my emails.

If you're security-conscious enough to be taking part in this discussion, you should probably be wary about typing your passwords into someone else's computer in the first place.

Re: Tired of memorizing passwords? Manuel Blum came up with this algorithmic trick

#49

I've often wondered why login systems don't simply rely on the same system they use for password recovery. Instead of logging in with a username and password, why not request a login token that is emailed to me. I then use that link to access the site and never really have to think about passwords.

Users would despise the lack of convenience.
Post reply on HN