4 ms·

You know, I just had a thought. What I would like is password protected, "password notepad". When activated, it remembers the text of passwords, shows it to yo

You know, I just had a thought. What I would like is password protected, "password notepad". When activated, it remembers the text of passwords, shows it to you in text when you go to a website and then you type it into the site. (people looking over your shoulder is a way overestimated danger, the password-hiding thing dates to shared terminals). The thing I hate about password managers is I am afraid I would stop knowing my passwords. This would allow me to remember my passwords since I would type them each time. I've only seen Firefox and Chrome's built-in password managers so maybe this exists already. But it seems a decent way to do it.

Ao7bei3s 7y ago
Your proposal: * Encourages bad (easy to type, and potentially memorable) passwords and password reuse (probably the single best way to get compromised). (I have several hundreds of unique passwords.) * Makes phishing easier. (People are bad at consistently checking the URL bar correctly char for char and every time.) * Is inconvenient. * Can be done with any existing password manager. * About shoulder looking... I don't know about you, but I frequently need my passwords at work when colleagues are watching, or when I'm sharing my screen in a (often recorded) conference call.
- joe_the_user 7y ago
  "Encourages bad passwords" - It seems pretty implausible a sequence of word-number-word-number is going to be inherently that weak. "Makes phishing easy" - The manager would be checking the URL bar in the same fashion as a regular password manager. "Is inconvenient" - Is not terribly inconvenient "Can be done with any existing password manager" - Great, I suppose I should just get started using them then.
viraptor 7y ago
If you can remember your passwords, they're likely not great passwords to begin with. I've got hundreds of logins and remember only 2 - the password manager one and gmail which a lot of important things hang off of. The big issue these days is users sharing a password between sites, so having them unique/random is the game.
- joe_the_user 7y ago
  So it seems like the plan is to just move from the single password to the password manager as the single point of failure.
  - CuriousSkeptic 7y ago
    It’s an interesting tradeoff. In the one hand you have a single, low entropy, shared secret you give out to any stranger offering you an account. On the other hand you have only a single stranger to trust who can keep track of unique high entropy secrets for all those other strangers. But it’s a very well known entity that many malicious actors are circling attempting to find a weakness, and it’s not only keeping your shared secret(s) it’s also keeping a record of every service you have an account with.
kcolford 7y ago
The point of the password manager is that you don't remember your passwords.
gregmac 7y ago
> The thing I hate about password managers is I am afraid I would stop knowing my passwords. That is a feature. The handful of passwords I know are mostly long passphrases. The rest are long random strings, generally up in the 30-something character range. In fact, I don't even know some of my logins anymore: I will use or at least append random characters to most accounts that don't have any 'social' functions (that I care about). I also use a unique email per site. If an account is compromised, it's got a very low chance it'll even connect to another account I own (at least not without human interpretation), and zero chance of helping with cracking any of my other passwords (other than hinting you can skip guessing anything <30 characters). I have backups of my password file, I have email recovery (to a domain I own) - knowing individual accounts is just unnecessary.
- snypox 7y ago
  How do you have unique emails per site?
  - ashton314 7y ago
    Not OP, but just a guess: you can use tags in your email (add `normal-email+tag-here@domain.org`) and it should go to the same location. If you host your own mail or have your own domain with an… M record? I don’t know—then you can easily create as many emails as you want and forward them to other accounts.
    - stinos 7y ago
      Some overly strict checks on some websites don't allow tags, but if you host yourself there's also the possibility to use `normal-email@whatever.domain.org`. Pretty convenient for filtering.
  - croon 7y ago
    I have a domain just for emails, so any mail sent to the domain goes to me, so I can just sign up for a site as hackernews@mydomain.tld or whatever system i want for naming stuff. I still get every mail to the same mailbox, but if I start getting spam, I know which site sold my email, or got hacked.
blunte 7y ago
You don't realize how often in public places there are cameras recording you. Whether it's the password they see in the clear on your screen or you physically typing, it's a risk that you don't have when you use a copy/paste password manager.
stordoff 7y ago
> people looking over your shoulder is a way overestimated danger Depends on your environment. I personally have learnt at least two people's email passwords just from watching them type (not to use, just to see how easy it was), and I've seen an instance of a Windows Domain admin password being shoulder-surfed. Making it easier seems questionable.

Ao7bei3s 7y ago

Your proposal: * Encourages bad (easy to type, and potentially memorable) passwords and password reuse (probably the single best way to get compromised). (I have several hundreds of unique passwords.) * Makes phishing easier. (People are bad at consistently checking the URL bar correctly char for char and every time.) * Is inconvenient. * Can be done with any existing password manager. * About shoulder looking... I don't know about you, but I frequently need my passwords at work when colleagues are watching, or when I'm sharing my screen in a (often recorded) conference call.

joe_the_user 7y ago
"Encourages bad passwords" - It seems pretty implausible a sequence of word-number-word-number is going to be inherently that weak. "Makes phishing easy" - The manager would be checking the URL bar in the same fashion as a regular password manager. "Is inconvenient" - Is not terribly inconvenient "Can be done with any existing password manager" - Great, I suppose I should just get started using them then.

viraptor 7y ago

If you can remember your passwords, they're likely not great passwords to begin with. I've got hundreds of logins and remember only 2 - the password manager one and gmail which a lot of important things hang off of. The big issue these days is users sharing a password between sites, so having them unique/random is the game.

joe_the_user 7y ago
So it seems like the plan is to just move from the single password to the password manager as the single point of failure.
- CuriousSkeptic 7y ago
  It’s an interesting tradeoff. In the one hand you have a single, low entropy, shared secret you give out to any stranger offering you an account. On the other hand you have only a single stranger to trust who can keep track of unique high entropy secrets for all those other strangers. But it’s a very well known entity that many malicious actors are circling attempting to find a weakness, and it’s not only keeping your shared secret(s) it’s also keeping a record of every service you have an account with.

kcolford 7y ago

The point of the password manager is that you don't remember your passwords.

gregmac 7y ago

> The thing I hate about password managers is I am afraid I would stop knowing my passwords. That is a feature. The handful of passwords I know are mostly long passphrases. The rest are long random strings, generally up in the 30-something character range. In fact, I don't even know some of my logins anymore: I will use or at least append random characters to most accounts that don't have any 'social' functions (that I care about). I also use a unique email per site. If an account is compromised, it's got a very low chance it'll even connect to another account I own (at least not without human interpretation), and zero chance of helping with cracking any of my other passwords (other than hinting you can skip guessing anything <30 characters). I have backups of my password file, I have email recovery (to a domain I own) - knowing individual accounts is just unnecessary.

snypox 7y ago
How do you have unique emails per site?
- ashton314 7y ago
  Not OP, but just a guess: you can use tags in your email (add `normal-email+tag-here@domain.org`) and it should go to the same location. If you host your own mail or have your own domain with an… M record? I don’t know—then you can easily create as many emails as you want and forward them to other accounts.
  - stinos 7y ago
    Some overly strict checks on some websites don't allow tags, but if you host yourself there's also the possibility to use `normal-email@whatever.domain.org`. Pretty convenient for filtering.
- croon 7y ago
  I have a domain just for emails, so any mail sent to the domain goes to me, so I can just sign up for a site as hackernews@mydomain.tld or whatever system i want for naming stuff. I still get every mail to the same mailbox, but if I start getting spam, I know which site sold my email, or got hacked.

blunte 7y ago

You don't realize how often in public places there are cameras recording you. Whether it's the password they see in the clear on your screen or you physically typing, it's a risk that you don't have when you use a copy/paste password manager.

stordoff 7y ago

> people looking over your shoulder is a way overestimated danger Depends on your environment. I personally have learnt at least two people's email passwords just from watching them type (not to use, just to see how easy it was), and I've seen an instance of a Windows Domain admin password being shoulder-surfed. Making it easier seems questionable.