4 ms·

People trusting a third party for their passwords boggles my mind.

• crummy 10y ago
  Where do you write yours down?
  • bimmer44 10y ago
    I'd recommend Pass [1]. It stores your data locally, is suprisingly easy to use and relies on battle tested GPG. From the website: "The community has even produced a cross-platform GUI client, an Android app, an iOS app, a Firefox plugin, a Windows client, a pretty Python QML app, a nice Go GUI app, an interactive console UI, Alfred integration (1) (2) (3), a dmenu script, OS X integration, git credential integration, and even an emacs package." [1] https://www.passwordstore.org/ https://www.passwordstore.org/
    • Freak_NL 10y ago
      If safety is your primary concern though, stick with just the command line client, which is a Bash script most HN-readers will be able to follow to the letter. It in turn uses GnuPG. The lack of integration then with the rest of the OS is actually a security benefit.
  • pdkl95 10y ago
    On paper. https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... https://www.schneier.com/news/archives/2010/11/bruce_schneier_write.html https://www.schneier.com/news/archives/2010/11/bruce_schneie...
  • IshKebab 10y ago
    I memorised a very simple algorithm to construct passwords from the domain name of a site. Then I concatenate that with one of three fixed portions depending on how important I view the site (e.g. banks get the most secure one, then gmail, then everything else). It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated attacker) to work out my algorithm. For example, my 'insecure' fixed part might be 'Tenk5$' (I recommend including uppercase, lowercase, a number and a symbol in that part to get around idiotic password requirements). Then my algorithm could be 'the last 5 letters backwards, skip the first vowel'. In which case my password for HN would be 'Tenk5$rtani'.
    • progx 10y ago
      Problem is, that not all sites use the same style of passwort. Some need Lower-/Uppercase, some with numbers, some with special Chars, some restrict to minimum of x chars, some use a maximum. Your system works not for all things, i use a similar system, but store a bunch of passwords with last pass. Only really important passwords are in my head.
      • IshKebab 10y ago
        Yes, occasionally sites don't allow it, but I've found if you use at least one of: uppercase, lowercase, numbers and symbols, and have a length of around 10, then it will go through virtually all sites. I keep meaning to collate idiotic password rules so you can see for sure which patterns work in all of them, but I've never got around to it.
      • qmr 10y ago
        > Only really important passwords are in my head. That has not worked well for me. I have lost a small amount of bitcoin, and some encrypted homedirs and encrypted hard drives.
    • agentgt 10y ago
      I do a vaguely similar thing but I don't share it with the world :)
      • IshKebab 10y ago
        That's not the actual system I use obviously.
    • kps 10y ago
      I use a method like that, but the result of that step then goes through PwdHash (whose code is small enough to inspect for naughtiness) so that multiple web sites wouldn't expose the scheme.
    • slavik81 10y ago
      > it would take several compromises (and a weirdly dedicated attacker) to work out my algorithm. Use that algorithm widely enough and several compromises are guaranteed. The only thing protecting your password is that url manipulation.
  • zaynetro 10y ago
    We use KeyPassX in our company.
  • zouhair 10y ago
    Keepass(x).
• viraptor 10y ago
  Well, there's always a balance with usability. password reuse < own memory/manual storage < synced unencrypted 3rd party storage < synced encrypted 3rd party storage < custom encrypted storage < some custom crazy HSM which doesn't allow you to get more than X passwords per minute and notifies you on each get() There's another dimension for cross-platform support somewhere in there. At the moment if you want your passwords saved and shared between desktops and mobiles, the best solution I'm aware of is 1password with separate sync (dropbox/icloud) - and you're still trusting the 1password app. You can go further, but you're starting to destroy usability on the way. Lastpass / 1password is still a valid choice that's better than many alternatives.
• lucideer 10y ago
  Perhaps, but this particular exploit doesn't target the fact your passwords are stored in the cloud. It targets the local autofill functionality in the browser, so it could conceivably have occurred in any password manager with browser/autofill integration. Including those that use a local password store.
  • gpvos 10y ago
    Do you mean it could happen with, say, Firefox's built-in password manager?
    • mattmanser 10y ago
      Yes, it's exactly the equivalent of someone finding a bug with the auto-password fill functionality in Chrome or Firefox or IE to trick the browser into filling in a password on an unrelated site.
    • aryamaan 10y ago
      Yes, sir. What's happening is that this extension auto filling the password in unintended sites. Where it is getting passwords from (offline or from cloud) is immaterial for this case.
    • lucideer 10y ago
      It happens at the point that the browser functionality interacts with a webpage on the internet that is controlled by a third-party. A well-written autofill function will strictly only allow the 3rd-party website code to access passwords for logging into that domain - the Lastpass allows it to capture passwords for other domains. This bug could easily occur in Chrome/Firefox's built-in password manager autofill, though I must admit I have slightly more implicit trust of the developers behind Chrome/Firefox than of Lastpass (instinctively; this may well be unwarranted).