4 ms·

I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate pass

by meuk 8y ago

I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate passwords every month, and am not allowed to store passwords somewhere. Of course, this method requires you to remember more passwords than practically possible. If all accounts would have sane restrictions on the password it would become trivial to have something both secure and convenient. I have been looking for a system that allows me to: 1. Does not require me to remember an absurd amount of information. 2. Allows me to login to services, even from other devices. 3. Has a unique password for each service (so that it is not disastrous if one password leaks). We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would only require you to pick and remember a strong master password.

jki275 8y ago
I know that environment well, you pretty much have to come up with a hash function you can do in your head. Is it secure? Maybe you can pull it off. I think most people can't, and that's what leads to people writing down passwords.
- ryan-c 8y ago
  Writing down passwords is usually less bad than password reuse and use of weak passwords.
  - jki275 8y ago
    Depending on the physical security posture of the location where the passwords are stored, that can be a correct statement. I wouldn't argue "usually" simply because most people aren't smart about where they're stored.
    - taco_emoji 8y ago
      It depends on the threat vector, though. Printing out my passwords in 72-pt font and taping them to the wall is obviously insecure if I leave them up for the house cleaner to see, but there's zero risk that a remote attacker will see them (barring them taking over the webcam or something, but at that point they probably have root access anyway).
      - jki275 8y ago
        Or paying your housecleaner to take a picture and email it to them...
  - jermaustin1 8y ago
    Its the same concept of the majority of offline password managers. You are hiding all of your amazing 32 character randomly generated unique passwords behind a single memorable password. BUT its safe, because unless YOU are the target of the attack, the contents of your random slip of paper on your desk, or the password protected one note file on your dropbox, or the encrypted pwsafe3 file on your usb stick are outside of the reach of some bad actor trying to get ALL of the passwords, not just YOUR password.
    - ryan-c 8y ago
      Did you reply to the wrong comment? Normally, to attack a password manager, you must have a copy of its database. With a deterministic password scheme, this is not required. This proves to be disastrous in practice for cryptocurrencies.
      - jermaustin1 8y ago
        No, I'm saying writing your password down in a notebook on your desk in your locked office is nearly as safe as any offline password manager. If you aren't the one under attack, and you still create different passwords for each service, the method of offline password storage (be it a spread sheet, a password manager, or a sticky note) are all similarly-ish safe.
hyperpape 8y ago
Once you have a counter, you have state, and you might as well just use a password manager. It may be you're working in the one environment where the master password + derived password scheme + counter scheme would be an improvement, but the above objection is why it doesn't work well for most users.
chromaton 8y ago
Password card.
Spooky23 8y ago
The key is to come up with a repeatable pattern that defeats whatever repeatable pattern detection that is in place and just apply it. You don't write down the password, you write down parts of the pattern. Is it secure? No. But if you work at a place where SSO isn't a thing in 2018, it's not secure anyway.
- bradstewart 8y ago
  This. I had a keyboard pattern I used in a similar environment. Just shift a row over every month. I couldn't ever tell you what the password was from memory, but could type it in no problem. This is bad security advice. Don't this if at all possible.
ryan-c 8y ago
> We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would only require you to pick and remember a strong master password. This has been tried. While it initially sounds appealing, it is a monumentally terrible idea. * You need software to implement the scheme. * Rotation is a problem, you need a counter for state * Different services have widely different password rules which are additional state * If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked * People choose passphrases just as badly as they choose passwords Just write your passwords down. Maybe leave a few characters off or don't label them.
- onepostoneacct 8y ago
  > * If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked. It all comes down to the threat model you are defending against. The threat model I'm defending against is automated attempts to catch me reusing the same password with different accounts. Even if you were defending against a motivated actor putting human eyes on your passwords, something like`XXXXXXsXXXXXXsssXX` where the X are reused across sites and the s is a derived, site-specific chunk is a) as good as completely random until your adversary is manually correlating multiple leaked passwords for you and b) not trivially obvious to derive once they are correlating multiple leaked passwords.
  - ryan-c 8y ago
    > until your adversary is manually correlating multiple leaked passwords for you This is a thing that is done, and even automated. If you have a couple password dumps, checking levenshtein distance between them is not hard.
tln 8y ago
> I currently work in an environment where I don't have access to a password manager How is that reasonable? If you make a case that restricting password managers lowers security, could you possibly change it?

by meuk 8y ago

jki275 8y ago

I know that environment well, you pretty much have to come up with a hash function you can do in your head. Is it secure? Maybe you can pull it off. I think most people can't, and that's what leads to people writing down passwords.

ryan-c 8y ago
Writing down passwords is usually less bad than password reuse and use of weak passwords.
- jki275 8y ago
  Depending on the physical security posture of the location where the passwords are stored, that can be a correct statement. I wouldn't argue "usually" simply because most people aren't smart about where they're stored.
  - taco_emoji 8y ago
    It depends on the threat vector, though. Printing out my passwords in 72-pt font and taping them to the wall is obviously insecure if I leave them up for the house cleaner to see, but there's zero risk that a remote attacker will see them (barring them taking over the webcam or something, but at that point they probably have root access anyway).
    - jki275 8y ago
      Or paying your housecleaner to take a picture and email it to them...
- jermaustin1 8y ago
  Its the same concept of the majority of offline password managers. You are hiding all of your amazing 32 character randomly generated unique passwords behind a single memorable password. BUT its safe, because unless YOU are the target of the attack, the contents of your random slip of paper on your desk, or the password protected one note file on your dropbox, or the encrypted pwsafe3 file on your usb stick are outside of the reach of some bad actor trying to get ALL of the passwords, not just YOUR password.
  - ryan-c 8y ago
    Did you reply to the wrong comment? Normally, to attack a password manager, you must have a copy of its database. With a deterministic password scheme, this is not required. This proves to be disastrous in practice for cryptocurrencies.
    - jermaustin1 8y ago
      No, I'm saying writing your password down in a notebook on your desk in your locked office is nearly as safe as any offline password manager. If you aren't the one under attack, and you still create different passwords for each service, the method of offline password storage (be it a spread sheet, a password manager, or a sticky note) are all similarly-ish safe.

hyperpape 8y ago

Once you have a counter, you have state, and you might as well just use a password manager. It may be you're working in the one environment where the master password + derived password scheme + counter scheme would be an improvement, but the above objection is why it doesn't work well for most users.

chromaton 8y ago

Password card.

Spooky23 8y ago

The key is to come up with a repeatable pattern that defeats whatever repeatable pattern detection that is in place and just apply it. You don't write down the password, you write down parts of the pattern. Is it secure? No. But if you work at a place where SSO isn't a thing in 2018, it's not secure anyway.

bradstewart 8y ago
This. I had a keyboard pattern I used in a similar environment. Just shift a row over every month. I couldn't ever tell you what the password was from memory, but could type it in no problem. This is bad security advice. Don't this if at all possible.

ryan-c 8y ago

> We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would only require you to pick and remember a strong master password. This has been tried. While it initially sounds appealing, it is a monumentally terrible idea. * You need software to implement the scheme. * Rotation is a problem, you need a counter for state * Different services have widely different password rules which are additional state * If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked * People choose passphrases just as badly as they choose passwords Just write your passwords down. Maybe leave a few characters off or don't label them.

onepostoneacct 8y ago
> * If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked. It all comes down to the threat model you are defending against. The threat model I'm defending against is automated attempts to catch me reusing the same password with different accounts. Even if you were defending against a motivated actor putting human eyes on your passwords, something like`XXXXXXsXXXXXXsssXX` where the X are reused across sites and the s is a derived, site-specific chunk is a) as good as completely random until your adversary is manually correlating multiple leaked passwords for you and b) not trivially obvious to derive once they are correlating multiple leaked passwords.
- ryan-c 8y ago
  > until your adversary is manually correlating multiple leaked passwords for you This is a thing that is done, and even automated. If you have a couple password dumps, checking levenshtein distance between them is not hard.

tln 8y ago

> I currently work in an environment where I don't have access to a password manager How is that reasonable? If you make a case that restricting password managers lowers security, could you possibly change it?