4 ms·
I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a smal
by bikamonki 11y ago
I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors implement to defend its users, like SSL, 2FA or external devices.
- greggarious 11y agoStill, that's just one password. Do you use this one password for all your accounts, or as input to a password manager? Or are you just manually copying and pasting this one super good hash into all your accounts? :/
- bikamonki 11y agoDifferent phrases->hashes for each vendor. The brain can easily remember what short phrase corresponds to what vendor.
- scrollaway 11y agoUp until one of the vendor's databases leaks on the internet and we find out their passwords were stored in cleartext.
- subsection1h 11y agoI assume you have hundreds of accounts like I and most people I know have. If you can recall hundreds of passphrases, including passphrases for accounts that you don't access for several years, and you can continue recalling these hundreds of passphrases even while changing them regularly, how else are you making use of your exceptional memory? Just curious.
- bikamonki 11y agoI wish I had an exceptional memory ;) Only 4-5 accounts require a strong password. The rest I don't care, I use the same password or request a reset every time I go back.
- lqdc13 11y agoI do the same. However, sometimes that requires a phone call with a wait time of 30 minutes + identity verification =( This is the case with Blizzard.
- deleted 11y ago[deleted]
- DrScump 11y agoI make a record of them shrouded in a mnemonic that I can figure out but that would be useless to a stranger.
- bikamonki 11y agoI do manually copy/paste.
- Oogoo 11y agoI like this idea. It allows you do something as simple as: "[password phrase] + facebook" "[password phrase] + bank" etc for all of your passwords, and as long as the hasher works well, you have strong, random passwords for everything.
- DyslexicAtheist 11y agohave been tinkering with this idea also something like *echo -n 'my unique passphrase' |sha512sum* only issue is this shows up in your memory and on disk (e.g. .bash_history)
- veddan 11y agoPrefix the command with a space and bash won't save it in its history.
- Sophira 11y agoThis doesn't seem to be true in 4.3.42, at least not by default. " echo test" shows up in both the output of the 'history' builtin and in ~/.bash_history. Is it an option that needs to be set?
- reader_1000 11y agoYes, you need to have HISTCONTROL=ignorespace option in your .bashrc
- DyslexicAtheist 11y agogreat thanks didn't know this one. Just checked and there is also # don't put duplicate lines or lines starting with space in the history. # See bash(1) for more options HISTCONTROL=ignoreboth
- gregwebs 11y agosounds like one shall pass: https://oneshallpass.com/ https://oneshallpass.com/
- bikamonki 11y agoVery much the same (I was too lazy to use anything else than JS!) but my code has some built in tricks ;) What if an attacker constructs a very long list of phrases/term permutations based on one's social engineered data? Then run a loop (with zero restrictions) on 1SP code to get n possible hashes/pwds. That list could have the password! My code has one more layer of security: discover my tricks :) I like that 1SP is open source. One could download it and add complexity to it! But to use the 'standard' version is a risk.
- viraptor 11y agoWhat do you do on pages that require / forbid special characters and require / forbid length >8 characters?
- bikamonki 11y agoThats an easy tweak (global replace the forbidden characters after hash) on the hash generator and for the max length I normally just copy paste the required length.