4 ms·

My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be re

My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced. But I have a good memory and I trust it much more than my ability to keep things organized and make routine backups. It's easy for me to generate more or less secure passwords that I can memorize, like: shrebangodiKe24+ binarKedonado!3297 Miregofinar--0009 etc. Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore. Then, I'll be screwed.

avar 11y ago
Any password manager worth considering these days can sync across multiple computers given your master password.
- NoGravitas 11y ago
  Or you can just sync your encrypted password database over ownCloud or Syncthing, or whatever.
chime 11y ago
> My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced. Dropbox with KeepPass on Windows / KeePassX on Mac / MiniKeepPass on iOS works beautifully for me.
- distances 11y ago
  And KeePassX on Linux / KeePassDroid on Android. It's simple and works. The biggest issue is that the passwords are usually copied via the clipboard, so any program accessing the clipboard could copy your passwords. It's of course up to your own assessment whether this is a problem worth consideration or not.
  - NoGravitas 11y ago
    Consider using Keepass2Android rather than KeePassDroid. Instead of using the clipboard to transfer passwords, it provides an input method (a soft keyboard) that will type your passwords to your applications.
    - distances 11y ago
      Thanks for the tip, I'll try it out!
majewsky 11y ago
I've started to use a stateless password management scheme for that purpose: https://github.com/majewsky/pwget https://github.com/majewsky/pwget
- czechdeveloper 11y ago
  I've tried this (or similar, own implementation), but got stock on weird requirements that some services imposed. In about 50% of cases, I had to modify generated password anyway (usually make it shorter). So instead of remembering password, I had to remember what restriction which service had.
  - danielweber 11y ago
    Services should publish, in a computer-readable format, what the password requirements are. Unfortunately many places consider this information sensitive and protect it fiercely.
cpach 11y ago
”Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore.” I don’t think you need to worry about that. See https://news.ycombinator.com/item?id=3140898 https://news.ycombinator.com/item?id=3140898
sigio 11y ago
I use passwordstore.org's pass... which just syncs all the passwords via git (and they are encrypted with gpg). So I have redundancy/backup/versioning and the rest is just seperate (gpg'd) textfiles.
fredley 11y ago
I think this approach is better for your mom than for your average developer. I use LastPass and it continues to be difficult even for me to use, less savvy people wouldn't have a hope.
- fbnlsr 11y ago
  I'm also a Lastpass user, and while the service is near to flawless, I keep thinking that the UI is really bad. I wish they could work on that.
  - fredley 11y ago
    Yeah. It's slow, and just plain badly designed in places - crucial interactions hidden behind icon-only menus etc. I really hope they sort it out one day.
- r3bl 11y ago
  How is it difficult? I trust the security settings on my laptop, so I'm always logged in on my main browser. The process is as simple as entering the website and clicking on log in. When I register to something new, I just click on "save password". I generate passwords using Alt+G. Comparing this to not using password managers, (in my opinion) I would say that LastPass is both easier and safer alternative than not using one.
jwl 11y ago
I would recommend something like https://getvau.lt https://getvau.lt Generate your passwords with a simple algorithm with a servicename and a keyphrase. Works really well.
tajen 11y ago
Have we proven that password managers are safe? It's worth for black hats to spend as much money to break a password manager as the most expensive secret stored in it. If most of the secrets of the world are stored in there, ...
gist 11y ago
> But I have a good memory and I trust it much more Note that "a good memory" doesn't "scale" or remain constant over time. Plus more importantly you are assuming that something minor or major won't happen to you where for some reason you aren't able to remember things very clearly like you thought you would be able to.

avar 11y ago

Any password manager worth considering these days can sync across multiple computers given your master password.

NoGravitas 11y ago
Or you can just sync your encrypted password database over ownCloud or Syncthing, or whatever.

chime 11y ago

> My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced. Dropbox with KeepPass on Windows / KeePassX on Mac / MiniKeepPass on iOS works beautifully for me.

distances 11y ago
And KeePassX on Linux / KeePassDroid on Android. It's simple and works. The biggest issue is that the passwords are usually copied via the clipboard, so any program accessing the clipboard could copy your passwords. It's of course up to your own assessment whether this is a problem worth consideration or not.
- NoGravitas 11y ago
  Consider using Keepass2Android rather than KeePassDroid. Instead of using the clipboard to transfer passwords, it provides an input method (a soft keyboard) that will type your passwords to your applications.
  - distances 11y ago
    Thanks for the tip, I'll try it out!

majewsky 11y ago

I've started to use a stateless password management scheme for that purpose: https://github.com/majewsky/pwget https://github.com/majewsky/pwget

czechdeveloper 11y ago
I've tried this (or similar, own implementation), but got stock on weird requirements that some services imposed. In about 50% of cases, I had to modify generated password anyway (usually make it shorter). So instead of remembering password, I had to remember what restriction which service had.
- danielweber 11y ago
  Services should publish, in a computer-readable format, what the password requirements are. Unfortunately many places consider this information sensitive and protect it fiercely.

cpach 11y ago

”Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore.” I don’t think you need to worry about that. See https://news.ycombinator.com/item?id=3140898 https://news.ycombinator.com/item?id=3140898

sigio 11y ago

I use passwordstore.org's pass... which just syncs all the passwords via git (and they are encrypted with gpg). So I have redundancy/backup/versioning and the rest is just seperate (gpg'd) textfiles.

fredley 11y ago

I think this approach is better for your mom than for your average developer. I use LastPass and it continues to be difficult even for me to use, less savvy people wouldn't have a hope.

fbnlsr 11y ago
I'm also a Lastpass user, and while the service is near to flawless, I keep thinking that the UI is really bad. I wish they could work on that.
- fredley 11y ago
  Yeah. It's slow, and just plain badly designed in places - crucial interactions hidden behind icon-only menus etc. I really hope they sort it out one day.
r3bl 11y ago
How is it difficult? I trust the security settings on my laptop, so I'm always logged in on my main browser. The process is as simple as entering the website and clicking on log in. When I register to something new, I just click on "save password". I generate passwords using Alt+G. Comparing this to not using password managers, (in my opinion) I would say that LastPass is both easier and safer alternative than not using one.

jwl 11y ago

I would recommend something like https://getvau.lt https://getvau.lt Generate your passwords with a simple algorithm with a servicename and a keyphrase. Works really well.

tajen 11y ago

Have we proven that password managers are safe? It's worth for black hats to spend as much money to break a password manager as the most expensive secret stored in it. If most of the secrets of the world are stored in there, ...

gist 11y ago

> But I have a good memory and I trust it much more Note that "a good memory" doesn't "scale" or remain constant over time. Plus more importantly you are assuming that something minor or major won't happen to you where for some reason you aren't able to remember things very clearly like you thought you would be able to.