21 ms·

Two-factor paper passwords

186 points by jgrahamc 11y ago

jgrahamc 11y ago
The first thing I tell people to do is secure their email with a good password and two factor authentication because if that gets hacked most other stuff can be hacked via password resets.
- fredley 11y ago
  Your email address is your identity online - everything but everything assumes this. I have strong passwords and 2FA on my main account. If it was hacked, an attacker could (for example), reset my password for my national security vetting portal account. On there is available to anyone who has my login (no 2FA for this, obviously), forms which detail everything about me, my partner, my parents. My total, actual identity. I am compelled to use this service for the work that I do. I hope neither it nor my email has any security breaches.
  - newjersey 11y ago
    Does it at least have a cool down period? Like if you try your username n times in the last hour, you get locked out and can't try any more for m hours?
    - fredley 11y ago
      I don't know, you tell me how secure you think it might be: https://www.nsv.mod.uk/ https://www.nsv.mod.uk/
      - jsingleton 11y ago
        Well, as it only supports TLS 1.0 and SSL 3 (C grade on SSL labs), plus looks like it's running an old version of Web Forms, I think you're probably fine. :/
atemerev 11y ago
My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced. But I have a good memory and I trust it much more than my ability to keep things organized and make routine backups. It's easy for me to generate more or less secure passwords that I can memorize, like: shrebangodiKe24+ binarKedonado!3297 Miregofinar--0009 etc. Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore. Then, I'll be screwed.
- avar 11y ago
  Any password manager worth considering these days can sync across multiple computers given your master password.
  - NoGravitas 11y ago
    Or you can just sync your encrypted password database over ownCloud or Syncthing, or whatever.
- chime 11y ago
  > My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced. Dropbox with KeepPass on Windows / KeePassX on Mac / MiniKeepPass on iOS works beautifully for me.
  - distances 11y ago
    And KeePassX on Linux / KeePassDroid on Android. It's simple and works. The biggest issue is that the passwords are usually copied via the clipboard, so any program accessing the clipboard could copy your passwords. It's of course up to your own assessment whether this is a problem worth consideration or not.
    - NoGravitas 11y ago
deleted 11y ago
[deleted]
crasp 11y ago
Pretty neat for the older generation, until you run into one of these sites that persist that they know how to properly do password security and require you to have at least 1 number, at least a 'special character' (of which the definition is often very vaguely described) it should contain of at least 8 characters and also be no longer than 12. You will soon come to the conclusion that it is still easier to teach people to use a password manager for this because these schemes are nice but only get you this far before you have to revert to remember that single password again.
- spenczar5 11y ago
  I don't understand how that wouldn't work within the system described in the blog post. Couldn't you just write down `anger lunar @1` and follow your personal secret munging rule, so it becomes `ngeraunarl@1` (or whatever)?
  - r3bl 11y ago
    The problem is that if you stumble upon three of these different requirement sites that break with your Two Step Authentication process as described in the article, you're going to forget about this rule.
    - wahsd 11y ago
      I don't see why you couldn't modify the concept to always include numbers and spacial characters. For example; your "password" could be a combination of words, numbers, and characters while the "thing you know" is something like capitalizing the even or odd first character corresponding with the even or odd number corresponding to the first letter of the site or company, and combine that with the even or odd sequenced number and character in their sequential location in the password or at the end or beginning of the entered password. I'm sure I could describe that more clearly if I tried.
      - mrb 11y ago
        Then you run into the problem of idiotic sites not allowing special characters, or numbers, or even uppercase (I am looking at you, rvtrader.com...) The second main reason passwords suck (after the fact users trend to choose weak passwords) is that developers implement all sort of contradicting password rules.
rolfvandekrol 11y ago
The amount of possible alterations (practical alteration that people actually come up with) of a diceware passphrase is, I think, much lower than the possible values of a 6 figure number (which is what most two factor applications use). If you think hard, you'll come up with maybe 100 possible alterations. I wouldn't trust this scheme as my password manager. I use 1password, which feels a lot safer to me.
- guava 11y ago
  To be fair to the author, he does write the following at the end of the post: > PS If you are planning to do this... please consider using a password manager first. which shows that he is aware that this is only a second-choice solution.
- atonse 11y ago
  As the author says multiple times, before you try this, please at least try to use a password manager.
- falcolas 11y ago
  Ironically, you're frequently safer with a written down password than you are a password that is stored on your computer. For example, to get your password book, the attacker must have physical access to you. This immediately lowers the attack surface. Your passwords can't be sniffed out of your clipboard. Your passwords can't be brute-forced by someone who compromises by one of your accounts (even the account which stores the encrypted password vault). You can burn your password book to ensure secure deletion. Yeah, a password manager is still probably better; even the OP acknowledges that. OTOH, how secure is your password to access that manager? How frequently do you rotate it? What happens when that password is compromised?
coredog64 11y ago
Why not just a laminated password card that stays in the wallet/purse? http://www.passwordcard.org/en http://www.passwordcard.org/en
- pavel_lishin 11y ago
  It's not a bad idea, but there's a few problems: 1. I would 100% forget which symbol goes with which site. 2. The length I choose for my password may be too long/short for a given site. 3. Some sites require special symbols; some sites forbid them. Now I have to pick out my symbol based on the site's requirements, not ease of memorization.
  - splintercell 11y ago
    One solution to the site restrictions regarding symbols would be that you generate a non-symbol password, and a symbol substring. You add the symbol substring when you know that the site requires symbols (or if the non-symbol password fails).
  - awqrre 11y ago
    We need a website like http://plaintextoffenders.com/ http://plaintextoffenders.com/ but for the ones that have hurtful password rules.
  - anon6622 11y ago
    I use passwordcard too and when I get a site that clashes with my algorithm, I give them one of 4-5 passwords that I used to reuse everywhere before I implemented the scheme. I have a 6-symbol password, a 10-symbol password with special characters, sure they've also been used on a dozen other sites but if their super special requirements make me extra secure who am I to blame them, I'll use my super special passwords that fit :^) I could use a password manager but I don't want to be dependent on one piece of software, there's too many failure modes. It's already bad enough that all my accounts share a limited set of email addresses. The main issue I have with schemes like this is that there's no repository of global identifiers for websites and services. I can build a password for blizzard.com, starting from say "bl", then I forget about it and five years later their website is now activision.com, and I wonder why I can't log in with a password built from "ac". It's a minor issue since password resets are a thing and rebrands are rare but still..
PeterWhittaker 11y ago
If someone steals the book, you're done. Sorry. Unless the words are merely suggestive of actual passphrase, an attacker with the book will break your accounts very, very quickly. Reference? https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html https://www.schneier.com/blog/archives/2014/03/choosing_secu... Ten years ago, this scheme might have worked, but now, attackers now about such schemes and have integrated them into their tools. Yes, LastPass and its ilk have their challenges, but they are far superior to this security snake oil.
- bradjohnson 11y ago
  How is that any worse or more likely than if you use the same password for all sites and one is compromised? The author clearly states that this is only an alternative option if you are not willing to use a password manager.
  - PeterWhittaker 11y ago
    The author clearly states that this is only an alternative option if you are not willing to use a password manager. Which means it is no alternative at all. I'm a professional security consultant. If a client were to ask me to list the alternatives to using a password manager, I would say "Being hacked". They would ask what else? I would say "That's it, that's the list". Bad security advice is as bad as no security advice. Having amateurs provide well-intentioned, well-stated, well-described, terrible, terrible ideas, ideas articulated well enough that they seem plausibly good, and having them being supported by people who ought to know better does the entire industry a disservice. What would I tell my Mom? "I'm sorry, I really am, I know it's hard to use, but it really is the best alternative, the only really secure alternative, unless you want to keep a book of really strong passwords locked in your desk and only ever use your computer there." Which, for average users and average use cases, is no alternative at all.
    - bradjohnson 11y ago
      You're being purposefully obtuse if you think that every single person that doesn't use a password manager will get hacked... This advice is meant for people who will NOT use a password manager, which, believe it or not, is a large majority of the population. Look at the statistics for password use, it is undeniably more safe to use this method than to use "123456" or "password" which is the most likely alternative.
zokier 11y ago
Instead of silly obfuscation techniques a far more simpler and secure solution would be to append a memorized master password to the written password.
- ComputerGuru 11y ago
  Until one db is hacked and everyone in the world knows your master password.
  - danielweber 11y ago
    That is the same problem as the proposed method in the article, as the article admits.
  - fweespee_ch 11y ago
    Well, they'd also need the codebook where you store the passphrase to get the other half of the password. So if you change the master password regularly, they'd need to hack a database in that time window and steal your codebook. I highly doubt anyone would put that level of effort in.
    - csours 11y ago
      I kind of expect that if a determined hacker targets you (or me) specifically, we will get pwnt. The tradeoff is in how determined the hacker is and what the payoff is.
  - oh_sigh 11y ago
    So now an attacker needs access to both the hacked DB, and your physical book. I think that that format acceptably blocks the two most dangerous groups for a persons privacy: tech savvy remote hackers, and tech inept local snoopers. Remote hackers are tech savvy, but probably don't have physical access to your house and don't care enough about a single user to get it. Local snoopers are probably not tech savvy, and therefore probably won't have access or know how to find a hacked database. If there really is a tech savvy local snooper, they will know they can just install a keylogger onto the computer that they almost certainly also have physical access to.
theophrastus 11y ago
Generate a 36x36 matrix of random (password suitable) characters indexed along ordinate and abscissa with a-z0-9. Two things to remember: a two character key to a password (e.g. 'am' for amazon, 'w3' for a third work related password) and a scheme for tracing a path through this tabula recta[1] following after the first character indexed by the key (e.g. spiral to the left until 12 characters are accumulated). Make two copies of the same matrix, put one in your wallet and the backup in your safe deposit box [2]. [1] https://en.wikipedia.org/wiki/Tabula_recta https://en.wikipedia.org/wiki/Tabula_recta [2] http://lifehacker.com/5715794/how-to-write-down-and-encrypt-your-passwords-with-an-old-school-tabula-recta http://lifehacker.com/5715794/how-to-write-down-and-encrypt-...
- wflynny 11y ago
  What happens when one password is leaked somehow? Do you then have to reinitialize the matrix and reset all your passwords? You also have the problem of some domains requiring alphanumeric only, etc., which then limits what characters you can use in all your passwords.
  - theophrastus 11y ago
    leaked password: choose a new/different two char index or path scheme. alphanumeric only (some would say avoid such sites [shrug]): just continue along the path skipping over the non-alphanumerics until you've got the length you want.
  - 0xdeadbeefbabe 11y ago
    Knowing one password is leaked somehow isn't an easy problem to solve. Why assume it is?
Lxr 11y ago
Here is a fairly simple alternative to this or using a password manager: 1. Remember a high-entropy “base” password that is likely to pass complexity and length requirements 2. Invent a weird way to incorporate the name or domain name of the product you’re using into this password to make it unique (e.g. “put the second letter of the domain name as the third-last character of your password”) Advantages: Memorable but unique password for all or most services, no need for physical books that can be stolen, works on any machine. If one of your passwords is discovered, it's basically useless beyond that service unless the attacker knows your step 2.
- nommm-nommm 11y ago
  Disadvantages: do I have an account on this site? What email address did I use to sign up? What is my username (Many have user name requirements)? My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters. Now you are remembering tons of special cases. If you are specifically targeted they can compare your password in two hacked databases and find out your scheme.
  - Lxr 11y ago
    do I have an account on this site? What email address did I use to sign up? Fair point but often there are not too many possibilities. What is my username Your email address, in most cases. My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters. Occasionally a problem, but I have been using this method for years and have maybe two or three passwords that I have to manually remember for reasons like this. If you are specifically targeted they can compare your password in two hacked databases and find out your scheme. True, but then one can similarly come up with scenarios for most other schemes. I agree it's not perfect and won't cover every case, but it has worked well for me.
    - 11y ago
mistercow 11y ago
Problem with this is that the entropy contribution of what you keep in your head is minimal. If someone gets your book, you're hosed.
n72 11y ago
Why not just use this? http://fabrianoboutique.eu/agenda-logins-and-passwords-564.html http://fabrianoboutique.eu/agenda-logins-and-passwords-564.h...
jsingleton 11y ago
Anyone else get the CloudFlare CAPTCHA for the diceware link? Ironic if John's blog caused more checks for that site. https://www.rempe.us/diceware https://www.rempe.us/diceware
- jgrahamc 11y ago
  I did
mikegerwitz 11y ago
On a similar note, gnu-pw-mgr uses a memorized transformation on a URL to generate passwords on-the-fly deterministically, so no password are ever actually stored: https://www.gnu.org/software/gnu-pw-mgr/ https://www.gnu.org/software/gnu-pw-mgr/
elchief 11y ago
Email is your #1 security concern as that's where password resets go. Do yourself a favour and use Chrome, buy two U2F keys, register them both, and put one in a safe-deposit box. It's also phishing-proof, unlike SMS or TOTP.
- mongol 11y ago
  Not bad advice although the sites supporting u2f are not so many. Google, github, and...?
- theandrewbailey 11y ago
  Yeah, let's all use this one browser! Soon: Chrome is the new IE.
  - stephenr 11y ago
    That happened a long time ago when Google started pestering users of its web properties to use Chrome.
- lewiseason 11y ago
  Don't think Chrome is a dependency. Firefox has u2f support now (possibly through an extension?)
- stephenr 11y ago
  I'm not sure I understand the phishing vulnerability of SMS or TOTP tokens?
joesmo 11y ago
Slightly off topic, but I wanted to use a password manager and installed Lastpass Premium. Great, except for the fact that it won't update passwords and often times fills in the wrong password despite my verifying that it actually stores the right one. It's completely unreliable. Thankfully, I haven't started resetting all my passwords, but that also makes the password manager useless. After paying for that, I wonder if there is a password manager that actually works and is reliable. I've read great things about many packages, but in almost every case, I've also read great things about Lastpass which is atrocious and was definitely not worth even $12 / year. Needless to say, I don't trust any of those reviews.
- sandyarmstrong 11y ago
  I don't have the problems with LastPass that you have, but if I did, I would still find it handy for secure password generation, sync, and backup. You could just open the LastPass Vault in a separate window and copy passwords out of there and it would still be worth $12/year for me. That being said, try right-clicking in credential fields to find more fine-grained account selection. And maybe stop by their support to find out if something is wrong with your setup.

186 points by jgrahamc 11y ago

The first thing I tell people to do is secure their email with a good password and two factor authentication because if that gets hacked most other stuff can be hacked via password resets.

fredley 11y ago
Your email address is your identity online - everything but everything assumes this. I have strong passwords and 2FA on my main account. If it was hacked, an attacker could (for example), reset my password for my national security vetting portal account. On there is available to anyone who has my login (no 2FA for this, obviously), forms which detail everything about me, my partner, my parents. My total, actual identity. I am compelled to use this service for the work that I do. I hope neither it nor my email has any security breaches.
- newjersey 11y ago
  Does it at least have a cool down period? Like if you try your username n times in the last hour, you get locked out and can't try any more for m hours?
  - fredley 11y ago
    I don't know, you tell me how secure you think it might be: https://www.nsv.mod.uk/ https://www.nsv.mod.uk/
    - jsingleton 11y ago
      Well, as it only supports TLS 1.0 and SSL 3 (C grade on SSL labs), plus looks like it's running an old version of Web Forms, I think you're probably fine. :/

atemerev 11y ago

My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced. But I have a good memory and I trust it much more than my ability to keep things organized and make routine backups. It's easy for me to generate more or less secure passwords that I can memorize, like: shrebangodiKe24+ binarKedonado!3297 Miregofinar--0009 etc. Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore. Then, I'll be screwed.

avar 11y ago
Any password manager worth considering these days can sync across multiple computers given your master password.
- NoGravitas 11y ago
  Or you can just sync your encrypted password database over ownCloud or Syncthing, or whatever.
chime 11y ago
> My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced. Dropbox with KeepPass on Windows / KeePassX on Mac / MiniKeepPass on iOS works beautifully for me.
- distances 11y ago
  And KeePassX on Linux / KeePassDroid on Android. It's simple and works. The biggest issue is that the passwords are usually copied via the clipboard, so any program accessing the clipboard could copy your passwords. It's of course up to your own assessment whether this is a problem worth consideration or not.
  - NoGravitas 11y ago

deleted 11y ago

[deleted]

crasp 11y ago

Pretty neat for the older generation, until you run into one of these sites that persist that they know how to properly do password security and require you to have at least 1 number, at least a 'special character' (of which the definition is often very vaguely described) it should contain of at least 8 characters and also be no longer than 12. You will soon come to the conclusion that it is still easier to teach people to use a password manager for this because these schemes are nice but only get you this far before you have to revert to remember that single password again.

spenczar5 11y ago
I don't understand how that wouldn't work within the system described in the blog post. Couldn't you just write down `anger lunar @1` and follow your personal secret munging rule, so it becomes `ngeraunarl@1` (or whatever)?
- r3bl 11y ago
  The problem is that if you stumble upon three of these different requirement sites that break with your Two Step Authentication process as described in the article, you're going to forget about this rule.
  - wahsd 11y ago
    I don't see why you couldn't modify the concept to always include numbers and spacial characters. For example; your "password" could be a combination of words, numbers, and characters while the "thing you know" is something like capitalizing the even or odd first character corresponding with the even or odd number corresponding to the first letter of the site or company, and combine that with the even or odd sequenced number and character in their sequential location in the password or at the end or beginning of the entered password. I'm sure I could describe that more clearly if I tried.
    - mrb 11y ago
      Then you run into the problem of idiotic sites not allowing special characters, or numbers, or even uppercase (I am looking at you, rvtrader.com...) The second main reason passwords suck (after the fact users trend to choose weak passwords) is that developers implement all sort of contradicting password rules.

rolfvandekrol 11y ago

The amount of possible alterations (practical alteration that people actually come up with) of a diceware passphrase is, I think, much lower than the possible values of a 6 figure number (which is what most two factor applications use). If you think hard, you'll come up with maybe 100 possible alterations. I wouldn't trust this scheme as my password manager. I use 1password, which feels a lot safer to me.

guava 11y ago
To be fair to the author, he does write the following at the end of the post: > PS If you are planning to do this... please consider using a password manager first. which shows that he is aware that this is only a second-choice solution.
atonse 11y ago
As the author says multiple times, before you try this, please at least try to use a password manager.
falcolas 11y ago
Ironically, you're frequently safer with a written down password than you are a password that is stored on your computer. For example, to get your password book, the attacker must have physical access to you. This immediately lowers the attack surface. Your passwords can't be sniffed out of your clipboard. Your passwords can't be brute-forced by someone who compromises by one of your accounts (even the account which stores the encrypted password vault). You can burn your password book to ensure secure deletion. Yeah, a password manager is still probably better; even the OP acknowledges that. OTOH, how secure is your password to access that manager? How frequently do you rotate it? What happens when that password is compromised?

coredog64 11y ago

Why not just a laminated password card that stays in the wallet/purse? http://www.passwordcard.org/en http://www.passwordcard.org/en

pavel_lishin 11y ago
It's not a bad idea, but there's a few problems: 1. I would 100% forget which symbol goes with which site. 2. The length I choose for my password may be too long/short for a given site. 3. Some sites require special symbols; some sites forbid them. Now I have to pick out my symbol based on the site's requirements, not ease of memorization.
- splintercell 11y ago
  One solution to the site restrictions regarding symbols would be that you generate a non-symbol password, and a symbol substring. You add the symbol substring when you know that the site requires symbols (or if the non-symbol password fails).
- awqrre 11y ago
  We need a website like http://plaintextoffenders.com/ http://plaintextoffenders.com/ but for the ones that have hurtful password rules.
- anon6622 11y ago
  I use passwordcard too and when I get a site that clashes with my algorithm, I give them one of 4-5 passwords that I used to reuse everywhere before I implemented the scheme. I have a 6-symbol password, a 10-symbol password with special characters, sure they've also been used on a dozen other sites but if their super special requirements make me extra secure who am I to blame them, I'll use my super special passwords that fit :^) I could use a password manager but I don't want to be dependent on one piece of software, there's too many failure modes. It's already bad enough that all my accounts share a limited set of email addresses. The main issue I have with schemes like this is that there's no repository of global identifiers for websites and services. I can build a password for blizzard.com, starting from say "bl", then I forget about it and five years later their website is now activision.com, and I wonder why I can't log in with a password built from "ac". It's a minor issue since password resets are a thing and rebrands are rare but still..

PeterWhittaker 11y ago

If someone steals the book, you're done. Sorry. Unless the words are merely suggestive of actual passphrase, an attacker with the book will break your accounts very, very quickly. Reference? https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html https://www.schneier.com/blog/archives/2014/03/choosing_secu... Ten years ago, this scheme might have worked, but now, attackers now about such schemes and have integrated them into their tools. Yes, LastPass and its ilk have their challenges, but they are far superior to this security snake oil.

bradjohnson 11y ago
How is that any worse or more likely than if you use the same password for all sites and one is compromised? The author clearly states that this is only an alternative option if you are not willing to use a password manager.
- PeterWhittaker 11y ago
  The author clearly states that this is only an alternative option if you are not willing to use a password manager. Which means it is no alternative at all. I'm a professional security consultant. If a client were to ask me to list the alternatives to using a password manager, I would say "Being hacked". They would ask what else? I would say "That's it, that's the list". Bad security advice is as bad as no security advice. Having amateurs provide well-intentioned, well-stated, well-described, terrible, terrible ideas, ideas articulated well enough that they seem plausibly good, and having them being supported by people who ought to know better does the entire industry a disservice. What would I tell my Mom? "I'm sorry, I really am, I know it's hard to use, but it really is the best alternative, the only really secure alternative, unless you want to keep a book of really strong passwords locked in your desk and only ever use your computer there." Which, for average users and average use cases, is no alternative at all.
  - bradjohnson 11y ago
    You're being purposefully obtuse if you think that every single person that doesn't use a password manager will get hacked... This advice is meant for people who will NOT use a password manager, which, believe it or not, is a large majority of the population. Look at the statistics for password use, it is undeniably more safe to use this method than to use "123456" or "password" which is the most likely alternative.

zokier 11y ago

Instead of silly obfuscation techniques a far more simpler and secure solution would be to append a memorized master password to the written password.

ComputerGuru 11y ago
Until one db is hacked and everyone in the world knows your master password.
- danielweber 11y ago
  That is the same problem as the proposed method in the article, as the article admits.
- fweespee_ch 11y ago
  Well, they'd also need the codebook where you store the passphrase to get the other half of the password. So if you change the master password regularly, they'd need to hack a database in that time window and steal your codebook. I highly doubt anyone would put that level of effort in.
  - csours 11y ago
    I kind of expect that if a determined hacker targets you (or me) specifically, we will get pwnt. The tradeoff is in how determined the hacker is and what the payoff is.
- oh_sigh 11y ago
  So now an attacker needs access to both the hacked DB, and your physical book. I think that that format acceptably blocks the two most dangerous groups for a persons privacy: tech savvy remote hackers, and tech inept local snoopers. Remote hackers are tech savvy, but probably don't have physical access to your house and don't care enough about a single user to get it. Local snoopers are probably not tech savvy, and therefore probably won't have access or know how to find a hacked database. If there really is a tech savvy local snooper, they will know they can just install a keylogger onto the computer that they almost certainly also have physical access to.

theophrastus 11y ago

Generate a 36x36 matrix of random (password suitable) characters indexed along ordinate and abscissa with a-z0-9. Two things to remember: a two character key to a password (e.g. 'am' for amazon, 'w3' for a third work related password) and a scheme for tracing a path through this tabula recta[1] following after the first character indexed by the key (e.g. spiral to the left until 12 characters are accumulated). Make two copies of the same matrix, put one in your wallet and the backup in your safe deposit box [2]. [1] https://en.wikipedia.org/wiki/Tabula_recta https://en.wikipedia.org/wiki/Tabula_recta [2] http://lifehacker.com/5715794/how-to-write-down-and-encrypt-your-passwords-with-an-old-school-tabula-recta http://lifehacker.com/5715794/how-to-write-down-and-encrypt-...

wflynny 11y ago
What happens when one password is leaked somehow? Do you then have to reinitialize the matrix and reset all your passwords? You also have the problem of some domains requiring alphanumeric only, etc., which then limits what characters you can use in all your passwords.
- theophrastus 11y ago
  leaked password: choose a new/different two char index or path scheme. alphanumeric only (some would say avoid such sites [shrug]): just continue along the path skipping over the non-alphanumerics until you've got the length you want.
- 0xdeadbeefbabe 11y ago
  Knowing one password is leaked somehow isn't an easy problem to solve. Why assume it is?

Lxr 11y ago

Here is a fairly simple alternative to this or using a password manager: 1. Remember a high-entropy “base” password that is likely to pass complexity and length requirements 2. Invent a weird way to incorporate the name or domain name of the product you’re using into this password to make it unique (e.g. “put the second letter of the domain name as the third-last character of your password”) Advantages: Memorable but unique password for all or most services, no need for physical books that can be stolen, works on any machine. If one of your passwords is discovered, it's basically useless beyond that service unless the attacker knows your step 2.

nommm-nommm 11y ago
Disadvantages: do I have an account on this site? What email address did I use to sign up? What is my username (Many have user name requirements)? My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters. Now you are remembering tons of special cases. If you are specifically targeted they can compare your password in two hacked databases and find out your scheme.
- Lxr 11y ago
  do I have an account on this site? What email address did I use to sign up? Fair point but often there are not too many possibilities. What is my username Your email address, in most cases. My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters. Occasionally a problem, but I have been using this method for years and have maybe two or three passwords that I have to manually remember for reasons like this. If you are specifically targeted they can compare your password in two hacked databases and find out your scheme. True, but then one can similarly come up with scenarios for most other schemes. I agree it's not perfect and won't cover every case, but it has worked well for me.
  - 11y ago

mistercow 11y ago

Problem with this is that the entropy contribution of what you keep in your head is minimal. If someone gets your book, you're hosed.

n72 11y ago

Why not just use this? http://fabrianoboutique.eu/agenda-logins-and-passwords-564.html http://fabrianoboutique.eu/agenda-logins-and-passwords-564.h...

jsingleton 11y ago

Anyone else get the CloudFlare CAPTCHA for the diceware link? Ironic if John's blog caused more checks for that site. https://www.rempe.us/diceware https://www.rempe.us/diceware

jgrahamc 11y ago
I did

mikegerwitz 11y ago

On a similar note, gnu-pw-mgr uses a memorized transformation on a URL to generate passwords on-the-fly deterministically, so no password are ever actually stored: https://www.gnu.org/software/gnu-pw-mgr/ https://www.gnu.org/software/gnu-pw-mgr/

elchief 11y ago

Email is your #1 security concern as that's where password resets go. Do yourself a favour and use Chrome, buy two U2F keys, register them both, and put one in a safe-deposit box. It's also phishing-proof, unlike SMS or TOTP.

mongol 11y ago
Not bad advice although the sites supporting u2f are not so many. Google, github, and...?
theandrewbailey 11y ago
Yeah, let's all use this one browser! Soon: Chrome is the new IE.
- stephenr 11y ago
  That happened a long time ago when Google started pestering users of its web properties to use Chrome.
lewiseason 11y ago
Don't think Chrome is a dependency. Firefox has u2f support now (possibly through an extension?)
stephenr 11y ago
I'm not sure I understand the phishing vulnerability of SMS or TOTP tokens?

joesmo 11y ago

Slightly off topic, but I wanted to use a password manager and installed Lastpass Premium. Great, except for the fact that it won't update passwords and often times fills in the wrong password despite my verifying that it actually stores the right one. It's completely unreliable. Thankfully, I haven't started resetting all my passwords, but that also makes the password manager useless. After paying for that, I wonder if there is a password manager that actually works and is reliable. I've read great things about many packages, but in almost every case, I've also read great things about Lastpass which is atrocious and was definitely not worth even $12 / year. Needless to say, I don't trust any of those reviews.

sandyarmstrong 11y ago
I don't have the problems with LastPass that you have, but if I did, I would still find it handy for secure password generation, sync, and backup. You could just open the LastPass Vault in a separate window and copy passwords out of there and it would still be worth $12/year for me. That being said, try right-clicking in credential fields to find more fine-grained account selection. And maybe stop by their support to find out if something is wrong with your setup.