6 ms·

The best password manager is your own salting algorithm and memory.

cj 6y ago
> your own salting algorithm This can be an OK strategy as long as your salting algorithm is not easy enough to figure out by looking at a few password breaches that you (now or in the future) are exposed by. It can work if you’re smart about the algorithm, but if someone can guess your algorithm by looking at a few leaked passwords, it can provide a false sense of security.
- tediousdemise 6y ago
  That’s a thoughtful consideration. My logic is that a personal salting algorithm could be compromised after several points of failure, whereas a password manager can be compromised by a single point of failure. The former requires trust in myself to create a strong algorithm, and the latter requires trust in a black box.
  - scrollaway 6y ago
    It doesn't have to be a black box. There are open source password managers. Bitwarden and Keepassxc are two very good ones. And keep in mind that even if you can create a reasonably strong algorithm which will both be memorable and resistant to reverse engineering, most people won't. Password managers aren't just good for professionals, they're leagues ahead of anything "mere mortals" use. My mom uses 1password -- that's not a slight, I mean that literally; I put her on my family plan.
    - tediousdemise 6y ago
      I’m in support of password managers if they promote better security hygiene for the average user. Particularly, preventing the most heinous of all password crimes: reuse.
    - serial_dev 6y ago
      I use an open source password manager, but in the end, I still "trust a black box". I never looked into the source code in detail, nor would I have the knowledge to find some vulnerabilities that later can be used to expose my passwords. It might not be a black box for you, but for all intents and purposes it is for me.
scrollaway 6y ago
No, it is not. You want to back up your comment with some actual convincing arguments that human memory is better than the plethora of tools 1password offers? I know you won't because although it makes for a nice, witty comment on HN, it's such an absurd thing to actually consider at face value. Truly random, unique passwords for each website. OTP support and backups. Sharing with audit trails for teams. Encrypted files. The list is long.
- tediousdemise 6y ago
  I don’t need convincing arguments. A software password manager is a single point of failure, as the story demonstrates. It’s a dangerous external dependency with alluring convenience. Until mind reading becomes reality, nothing will ever be as secure as human memory.
  - scrollaway 6y ago
    And your mind, or whatever algorithm you came up with, isn't a single point of failure? You will never be one thousandth as good at securing hundreds of password as the most robust tools we have today. You may be good at remembering a couple of long, random passphrases. You can use those as a master password / encryption key. The software mentioned in the article is not a particularly good or trustworthy password manager, so no it doesn't make sense to put it in the same lot as the actually-good ones. Or to put it another way, if I come up with a crappy off brand version control software and backdoor it, that doesn't reflect badly on VCS, it reflects badly on me.
    - tediousdemise 6y ago
      I admit that there might be password managers out there that provide sufficient security for some users’ threat models, but I wouldn’t trust such a sensitive compilation of data on any computing system, especially ones with network access. If I used a password manager, it would have to be on an airgapped and password protected system, making it essentially useless for me. For me, it’s easier to memorize a password/salting algorithm that generates unique passwords to the website or service I’m using, so that I don’t have to actually memorize any passwords—only the algorithm.

cj 6y ago

> your own salting algorithm This can be an OK strategy as long as your salting algorithm is not easy enough to figure out by looking at a few password breaches that you (now or in the future) are exposed by. It can work if you’re smart about the algorithm, but if someone can guess your algorithm by looking at a few leaked passwords, it can provide a false sense of security.

tediousdemise 6y ago
That’s a thoughtful consideration. My logic is that a personal salting algorithm could be compromised after several points of failure, whereas a password manager can be compromised by a single point of failure. The former requires trust in myself to create a strong algorithm, and the latter requires trust in a black box.
- scrollaway 6y ago
  It doesn't have to be a black box. There are open source password managers. Bitwarden and Keepassxc are two very good ones. And keep in mind that even if you can create a reasonably strong algorithm which will both be memorable and resistant to reverse engineering, most people won't. Password managers aren't just good for professionals, they're leagues ahead of anything "mere mortals" use. My mom uses 1password -- that's not a slight, I mean that literally; I put her on my family plan.
  - tediousdemise 6y ago
    I’m in support of password managers if they promote better security hygiene for the average user. Particularly, preventing the most heinous of all password crimes: reuse.
  - serial_dev 6y ago
    I use an open source password manager, but in the end, I still "trust a black box". I never looked into the source code in detail, nor would I have the knowledge to find some vulnerabilities that later can be used to expose my passwords. It might not be a black box for you, but for all intents and purposes it is for me.

scrollaway 6y ago

No, it is not. You want to back up your comment with some actual convincing arguments that human memory is better than the plethora of tools 1password offers? I know you won't because although it makes for a nice, witty comment on HN, it's such an absurd thing to actually consider at face value. Truly random, unique passwords for each website. OTP support and backups. Sharing with audit trails for teams. Encrypted files. The list is long.

tediousdemise 6y ago
I don’t need convincing arguments. A software password manager is a single point of failure, as the story demonstrates. It’s a dangerous external dependency with alluring convenience. Until mind reading becomes reality, nothing will ever be as secure as human memory.
- scrollaway 6y ago
  And your mind, or whatever algorithm you came up with, isn't a single point of failure? You will never be one thousandth as good at securing hundreds of password as the most robust tools we have today. You may be good at remembering a couple of long, random passphrases. You can use those as a master password / encryption key. The software mentioned in the article is not a particularly good or trustworthy password manager, so no it doesn't make sense to put it in the same lot as the actually-good ones. Or to put it another way, if I come up with a crappy off brand version control software and backdoor it, that doesn't reflect badly on VCS, it reflects badly on me.
  - tediousdemise 6y ago
    I admit that there might be password managers out there that provide sufficient security for some users’ threat models, but I wouldn’t trust such a sensitive compilation of data on any computing system, especially ones with network access. If I used a password manager, it would have to be on an airgapped and password protected system, making it essentially useless for me. For me, it’s easier to memorize a password/salting algorithm that generates unique passwords to the website or service I’m using, so that I don’t have to actually memorize any passwords—only the algorithm.