4 ms·

You can still have the question. But my answer is a random 32 character string of alphanumerics :)

by ecoffey 11y ago

dheera 11y ago
I algorithmically generate the answers to the security questions with: answer = PBKDF2(hmacsha1, password + question, "", 100000, 16) This is also incidentally the basis for how I generate unique passwords for every service except banks, communication, and other sensitive things. I want a different password on every website and don't want to trust any password-remembering software I didn't write. The same function works fine for generating answers to secret questions.
- sarciszewski 11y ago
  This is morally equivalent to using a password manager to encrypt your passwords with a "master password". :)
  - dheera 11y ago
    Not really. I don't oppose using a master password, which I don't use anywhere directly or store on disk anywhere. I just don't want to trust closed-source code to manage passwords, and want to be able to generate the password to anything from anywhere without having to carry around an encrypted table of stored passwords. In this case, I implement it myself, with the help of some common open-source Python libraries.
    - sarciszewski 11y ago
      I did say "morally equivalent" rather than "technologically equivalent". By that, I mean the overall security of your password scheme is analogous to what people get out of a password manager.
      - tokenizerrr 11y ago
        Password managers are more secure. Here you just need the master password, with password managers you need the master password and the database file. Still, a lot better than password re-use.
    - tokenizerrr 11y ago
      > I just don't want to trust closed-source code to manage passwords KeePass? It's great, and open source.
    - equivrel 11y ago
      Have a look at pass [1], it's a minimalist tool in bash that is so simple you can easily make adjustments to it yourself. The codebase is very small so it is easy to audit. The principle is that your password are encrypted with your public key. You can then use git to keep running copies of your encrypted passwords on many devices. [1] - https://www.passwordstore.org/ https://www.passwordstore.org/
      - dheera 11y ago
        Thanks! This is interesting.

You can still have the question. But my answer is a random 32 character string of alphanumerics :)

by ecoffey 11y ago

You can still have the question. But my answer is a random 32 character string of alphanumerics :)

I algorithmically generate the answers to the security questions with: answer = PBKDF2(hmacsha1, password + question, "", 100000, 16) This is also incidentally the basis for how I generate unique passwords for every service except banks, communication, and other sensitive things. I want a different password on every website and don't want to trust any password-remembering software I didn't write. The same function works fine for generating answers to secret questions.

sarciszewski 11y ago
This is morally equivalent to using a password manager to encrypt your passwords with a "master password". :)
- dheera 11y ago
  Not really. I don't oppose using a master password, which I don't use anywhere directly or store on disk anywhere. I just don't want to trust closed-source code to manage passwords, and want to be able to generate the password to anything from anywhere without having to carry around an encrypted table of stored passwords. In this case, I implement it myself, with the help of some common open-source Python libraries.
  - sarciszewski 11y ago
    I did say "morally equivalent" rather than "technologically equivalent". By that, I mean the overall security of your password scheme is analogous to what people get out of a password manager.
    - tokenizerrr 11y ago
      Password managers are more secure. Here you just need the master password, with password managers you need the master password and the database file. Still, a lot better than password re-use.
  - tokenizerrr 11y ago
    > I just don't want to trust closed-source code to manage passwords KeePass? It's great, and open source.
  - equivrel 11y ago
    Have a look at pass [1], it's a minimalist tool in bash that is so simple you can easily make adjustments to it yourself. The codebase is very small so it is easy to audit. The principle is that your password are encrypted with your public key. You can then use git to keep running copies of your encrypted passwords on many devices. [1] - https://www.passwordstore.org/ https://www.passwordstore.org/
    - dheera 11y ago
      Thanks! This is interesting.