4 ms·

The only deterministic password manager you need is your own mind. Come up with a set of password rules that are generic enough to accommodate all these issues.

by ythn 10y ago

The only deterministic password manager you need is your own mind. Come up with a set of password rules that are generic enough to accommodate all these issues. For example my deterministic password manager might be: 1. random english wordx2 + first 4 letters of registered domain, all caps + remaining lowercase + number of letters in domain (integer) + symbols associated with digits of the integer digits 2. If site doesn't allow special characters, remove them 3. If site requires a shorter password than the generated one, trim the minimum number of characters from the front of the password until the criteria is met. So, using my above rules my password for Ycombinator would be: coppercopperYCOMbinator11!! If the site restricts passwords to max 12 characters, it would become: Mbinator11!!

deleted 10y ago
[deleted]
IshKebab 10y ago
> If the site restricts passwords to max 12 characters The problem with this is that most sites are designed by idiots and don't state their pointless password rules on the login page - only on the 'change password' page. So you can be trying your coppercopperYCOMbinator11!! password and thinking "why the hell doesn't this work?", then after 10 minutes you give up and go to change it and see "Your password must be between 8 and 12 characters and contain a symbol." So infuriating.
- ythn 10y ago
  That's very true. I forgot to mention that I also have a spreadsheet that has site-specific password rules so that I can do a lookup and see how I need to adapt my generated password. Maybe what we really need instead of deterministic password generators is an authoritative database that tracks the password rules of all the different sites on the internet so we can easily look it up and/or publicly shame companies with asinine password policies.
  - pavel_lishin 10y ago
    > I forgot to mention that I also have a spreadsheet that has site-specific password rules so that I can do a lookup and see how I need to adapt my generated password. So you do have a password manager. > Maybe what we really need instead of deterministic password generators is an authoritative database that tracks the password rules of all the different sites on the internet I'm glad to hear you volunteering to look up all of these policies, and keep them up to date!
- m3rc 10y ago
  This is exactly why I started using a password manager, the situation you described is infuriating. Additionally, all it takes is one site with poor security practices having a breach and someone could figure out your scheme and use it to figure out other sites passwords or even seed a dictionary attack with the "shape" of your passwords
- noir_lord 10y ago
  GitHub got me every bloody time on my companies account with this because they required a case change iirc. In the end I just changed it to something stupidly random and shoved it in keepassx, life's too short.
tptacek 10y ago
First, your proposed scheme relies on doubling words to get complexity without imposing too much of a tax on the user. But because passwords must be reasonable to type, that rule (and any rule like it --- I get that the "key" in this scheme is in part the weird rules you come up with) limits you to smaller words, which can very quickly be searched. Worse, an attacker who sees one of your passwords has a pretty decent shot at brute forcing the rules you use, and an attacker who sees two of them has the rules and has totally cracked your scheme. To get real entropy from english word passwords, you have to use several different words. In each password. Which: nobody is saying that's a bad idea. They're saying: you should just have 1Password do that for you, because keeping all those passwords in your head is a chore, and normal people cheat and reuse passwords.
- ythn 10y ago
  > Worse, an attacker who sees one of your passwords has a pretty decent shot at brute forcing the rules you use, and an attacker who sees two of them has the rules and has totally cracked your scheme. If an attacker is specifically targeting me and thinking about my passwords, there's not much I can do at that point. Password security in general kind of relies on attackers scanning huge quantities of credentials and going for the low hanging fruit. Plus, I still don't get why 1Password is better than a password generator on the 4th point. I get that yes you need 2 things (both the master key and the ciphertext), but how does that protect you? The cipher text is available to anyone who logs in. If I get your 1Password credentials, what's to stop me from logging into 1Password.com as you?
  - macintux 10y ago
    1Password doesn't ordinarily store your database (although I can't speak to the more recent team/cloud features). It's up to you to decide how to make them available to different devices, via Dropbox e.g. So, yes, if the attacker has access to your Dropbox and your master password, you're screwed, but that's a very high bar to hurdle.
  - eridius 10y ago
    1Password isn't a web-based password manager, it's an offline one that has a syncing component. Syncing is traditionally done either over WiFi (so no exposure to attackers), Dropbox, or iCloud. More recently 1Password now has an optional subscription model that gets you syncing + all updates to the app on all platforms. But the new built-in syncing uses a separate Account Key, which you provide along with your master password the first time you set up syncing on a particular device, and then you never use the account key again (until you have to set up a new device). This means you can store the account key in whatever secure manner you want without needing ease-of-access, and it means you won't ever accidentally type your account key into the wrong place and expose it to an attacker. So basically, if you use 1Password's built-in syncing, the attacker has to compromise your machine to get at your vault, just as they would have to do if you didn't do any syncing at all. If you use a third-party service for syncing (e.g. Dropbox, iCloud) they have to compromise that service. And of course in both cases they still need your 1Password master password.
kkl 10y ago
I think a password manager (minus some of the scary bits like browser plugins) is a much better option than a mental password generation scheme. Maybe some folks can handle this but I think this is a non-ideal general recommendation.
zeveb 10y ago
A password like that would probably be guessed by a good password cracker pretty quickly. I've taken the liberty of following your procedure for an un-named domain. If anyone's got a password cracker running, I'd be interested how long it takes to break this SHA256 hash: dae640f98b6894d2f6eab5755b22918be46b0d219ea10d3ceea06ebe538a75d1. Post once you've guessed it. Just use 'pwgen -s 22'; it generates 128-bit passwords, which will never be guessed.
- ythn 10y ago
  I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine). Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough. For example: Amazon: NovemberAlphaies12# Facebook: KiloFoxtrototto16& What's the ruleset? Answer: Phoenic alphabet of last + first letter of domain + italian number representing total letters in domain backwards + integer sum of the digits on either side of each digit in the Italian number + symbol representing sum of the digits of the previously calculated integer repeated until reduced to one digit. Seems like way too much work for an attacker to try to figure out.
  - shaftway 10y ago
    Frankly, the phonetics were trivial. So it's really... Amazon: ies12# Facebook: otto16& "Otto" made me think 8, and that led me to "sei" (I read stuff upside down when reading to my kids, so I flip letter orders easily). It didn't take long to figure out those were the length of the site. So now we're down to.... Amazon: 12# Facebook: 16& These follow a pattern (digit digit symbol), so even if I didn't notice that the symbols were only those above digits There are about 2000 possible choices. Or 11 bits of entropy. I didn't understand your number scheme, but I probably don't need to.
    - tripzilch 10y ago
      Yup that wasn't hard at all. Also, security researchers / consultants / ___hats solve these kinds of puzzles all the time for their work and hobby. Friends I have in that business are insanely good at this sort of thing. Because apparently people always think they're so clever. One told me on multiple cases doing whitehat security consulting they studied the desk+office of the sysadmin for a bit (no post-its), pull some Sherlock Holmes magic (I don't know really) and guessed the password in 5-10 tries (no I didn't quite believe it either, but otoh this guy really doesn't like bragging nor had any reason to lie about). Oh and if I understand the number scheme correctly: > integer sum of the digits on either side of each digit in the Italian number that means, when the number is "otto", meaning 8, the "digits on either side" are 7 and 9, which when you sum them, equal 7 + 9 = (8 - 1) + (8 + 1) = 8 + 8 = 16, so it's really a complicated way of saying "double that number" ... :-)

by ythn 10y ago

deleted 10y ago

[deleted]

IshKebab 10y ago

> If the site restricts passwords to max 12 characters The problem with this is that most sites are designed by idiots and don't state their pointless password rules on the login page - only on the 'change password' page. So you can be trying your coppercopperYCOMbinator11!! password and thinking "why the hell doesn't this work?", then after 10 minutes you give up and go to change it and see "Your password must be between 8 and 12 characters and contain a symbol." So infuriating.

ythn 10y ago
That's very true. I forgot to mention that I also have a spreadsheet that has site-specific password rules so that I can do a lookup and see how I need to adapt my generated password. Maybe what we really need instead of deterministic password generators is an authoritative database that tracks the password rules of all the different sites on the internet so we can easily look it up and/or publicly shame companies with asinine password policies.
- pavel_lishin 10y ago
  > I forgot to mention that I also have a spreadsheet that has site-specific password rules so that I can do a lookup and see how I need to adapt my generated password. So you do have a password manager. > Maybe what we really need instead of deterministic password generators is an authoritative database that tracks the password rules of all the different sites on the internet I'm glad to hear you volunteering to look up all of these policies, and keep them up to date!
m3rc 10y ago
This is exactly why I started using a password manager, the situation you described is infuriating. Additionally, all it takes is one site with poor security practices having a breach and someone could figure out your scheme and use it to figure out other sites passwords or even seed a dictionary attack with the "shape" of your passwords
noir_lord 10y ago
GitHub got me every bloody time on my companies account with this because they required a case change iirc. In the end I just changed it to something stupidly random and shoved it in keepassx, life's too short.

tptacek 10y ago

First, your proposed scheme relies on doubling words to get complexity without imposing too much of a tax on the user. But because passwords must be reasonable to type, that rule (and any rule like it --- I get that the "key" in this scheme is in part the weird rules you come up with) limits you to smaller words, which can very quickly be searched. Worse, an attacker who sees one of your passwords has a pretty decent shot at brute forcing the rules you use, and an attacker who sees two of them has the rules and has totally cracked your scheme. To get real entropy from english word passwords, you have to use several different words. In each password. Which: nobody is saying that's a bad idea. They're saying: you should just have 1Password do that for you, because keeping all those passwords in your head is a chore, and normal people cheat and reuse passwords.

ythn 10y ago
> Worse, an attacker who sees one of your passwords has a pretty decent shot at brute forcing the rules you use, and an attacker who sees two of them has the rules and has totally cracked your scheme. If an attacker is specifically targeting me and thinking about my passwords, there's not much I can do at that point. Password security in general kind of relies on attackers scanning huge quantities of credentials and going for the low hanging fruit. Plus, I still don't get why 1Password is better than a password generator on the 4th point. I get that yes you need 2 things (both the master key and the ciphertext), but how does that protect you? The cipher text is available to anyone who logs in. If I get your 1Password credentials, what's to stop me from logging into 1Password.com as you?
- macintux 10y ago
  1Password doesn't ordinarily store your database (although I can't speak to the more recent team/cloud features). It's up to you to decide how to make them available to different devices, via Dropbox e.g. So, yes, if the attacker has access to your Dropbox and your master password, you're screwed, but that's a very high bar to hurdle.
- eridius 10y ago
  1Password isn't a web-based password manager, it's an offline one that has a syncing component. Syncing is traditionally done either over WiFi (so no exposure to attackers), Dropbox, or iCloud. More recently 1Password now has an optional subscription model that gets you syncing + all updates to the app on all platforms. But the new built-in syncing uses a separate Account Key, which you provide along with your master password the first time you set up syncing on a particular device, and then you never use the account key again (until you have to set up a new device). This means you can store the account key in whatever secure manner you want without needing ease-of-access, and it means you won't ever accidentally type your account key into the wrong place and expose it to an attacker. So basically, if you use 1Password's built-in syncing, the attacker has to compromise your machine to get at your vault, just as they would have to do if you didn't do any syncing at all. If you use a third-party service for syncing (e.g. Dropbox, iCloud) they have to compromise that service. And of course in both cases they still need your 1Password master password.

kkl 10y ago

I think a password manager (minus some of the scary bits like browser plugins) is a much better option than a mental password generation scheme. Maybe some folks can handle this but I think this is a non-ideal general recommendation.

zeveb 10y ago

A password like that would probably be guessed by a good password cracker pretty quickly. I've taken the liberty of following your procedure for an un-named domain. If anyone's got a password cracker running, I'd be interested how long it takes to break this SHA256 hash: dae640f98b6894d2f6eab5755b22918be46b0d219ea10d3ceea06ebe538a75d1. Post once you've guessed it. Just use 'pwgen -s 22'; it generates 128-bit passwords, which will never be guessed.

ythn 10y ago
I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine). Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough. For example: Amazon: NovemberAlphaies12# Facebook: KiloFoxtrototto16& What's the ruleset? Answer: Phoenic alphabet of last + first letter of domain + italian number representing total letters in domain backwards + integer sum of the digits on either side of each digit in the Italian number + symbol representing sum of the digits of the previously calculated integer repeated until reduced to one digit. Seems like way too much work for an attacker to try to figure out.
- shaftway 10y ago
  Frankly, the phonetics were trivial. So it's really... Amazon: ies12# Facebook: otto16& "Otto" made me think 8, and that led me to "sei" (I read stuff upside down when reading to my kids, so I flip letter orders easily). It didn't take long to figure out those were the length of the site. So now we're down to.... Amazon: 12# Facebook: 16& These follow a pattern (digit digit symbol), so even if I didn't notice that the symbols were only those above digits There are about 2000 possible choices. Or 11 bits of entropy. I didn't understand your number scheme, but I probably don't need to.
  - tripzilch 10y ago
    Yup that wasn't hard at all. Also, security researchers / consultants / ___hats solve these kinds of puzzles all the time for their work and hobby. Friends I have in that business are insanely good at this sort of thing. Because apparently people always think they're so clever. One told me on multiple cases doing whitehat security consulting they studied the desk+office of the sysadmin for a bit (no post-its), pull some Sherlock Holmes magic (I don't know really) and guessed the password in 5-10 tries (no I didn't quite believe it either, but otoh this guy really doesn't like bragging nor had any reason to lie about). Oh and if I understand the number scheme correctly: > integer sum of the digits on either side of each digit in the Italian number that means, when the number is "otto", meaning 8, the "digits on either side" are 7 and 9, which when you sum them, equal 7 + 9 = (8 - 1) + (8 + 1) = 8 + 8 = 16, so it's really a complicated way of saying "double that number" ... :-)