10 ms·

Do you simply remember hundreds of random passwords?

w4rh4wk5 6y ago
Just note them down in a book? I know, it sounds stupid, but nowadays it's a lot easier to keep a small booklet save than a digital file on a connected machine.
- lmilcin 6y ago
  No, it is not stupid. It is strange how people get blinded by technology and forget about oldest, most reliable methods. I have worked as a security officer at a credit card acquirer (basically, processing credit card transactions between terminal and the bank). The process to safeguard your PINs is extremely complex but at the very end relies on pieces of paper with passwords and key components written down, put in tamper evident envelopes and then into safes.
  - jniedrauer 6y ago
    You're describing backups. The base derivation keys still have to exist in an HSM to be used. No one is opening a safe and hand-typing the BDK each time they need to issue a PIN encryption key.
    - lmilcin 6y ago
      It is not a backup. Backups are made just in case. In case of HSM keys, the HSM itself is built to loose those keys at the least pretense. It is also not possible to retrieve the keys. So whenever you want to provision a new HSM or even just move it couple centimeters (it looses keys when you try to move it) you have to go to the components written on paper. It is just like a password on a website -- you have to be entering it regularly. But once you enter the password you don't need to retype it for every HTTP request. Key components = password HSM = browser Message with PIN block = HTTP request
lmilcin 6y ago
I have couple of ways of dealing with the problem. -- Pen and paper? It is still a thing and cannot be stolen online. -- If you are afraid your family will access it without your knowledge, use tamper evident bag and a notepad to make notes of bag serial numbers. This prevents anybody from accessing it without your knowledge. -- Split the password into components so that even if somebody gets access to the piece of paper with the password they still can't log in. I make a note of the variable part of the password and remember a different prefixes/suffixes. I use different prefixes/suffixes for different classes of accounts. For most critical accounts I don't reuse anything. -- Use hardware (yubikeys) as second factor, to lessen pressure on the password. Unfortunately almost nobody implements these well. In most cases it is possible to turn off the second factor without presenting second factor which basically nullifies the value of it. If you use second factor on a site that implements it well, remember to have MULTIPLE copies of it. Keep it in triplicate, one with you, one in tamper evident bag and one offsite.
- StavrosK 6y ago
  Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.
  - swiley 6y ago
    You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.
    - CarelessExpert 6y ago
      Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android + browser plugins + syncthing. The idea of storing my passwords in someone else's cloud gives me the heebie jeebies...
II2II 6y ago
In my case, the most critical passwords are memorized and are not stored in any other medium after the brief period that it takes to memorize it. Simply put, I saw a breach like this coming and I anticipate many more in the future. Simply put, password managers are too big of a target. As for the rest, a written record is sufficiently secure since most of those login credentials aren't protecting anything important. I also have a tendency to avoid services that require a login.
cryptica 6y ago
It's easy. Just come up with a secret rule and derive the passwords from that rule such that the password is different for each website/service.
- scrollaway 6y ago
  Then the passwords are not secret, the rule is. And figuring out a rule with a couple of examples is much easier than breaking into an encrypted, properly secured password vault. In case I'm losing you, here's a parallel: if I ask you to pick and remember a random number between 1 and 1 billion, the odds of me figuring it out are low. But if I ask you to pick and remember 200 numbers between 1 and 1 billion, you will likely come up with "a rule", and then if I get a couple of example numbers (in a "password leak"), i can probably figure it out. The numbers are no longer secret, it's the rule that is.
  - edflsafoiewq 6y ago
    Generally the rule would be hash(master password ++ key).
    - scrollaway 6y ago
      Then you're just reimplementing a password manager... Badly.
      - cryptica 6y ago
        Well it could be your own secret hashing or concatenation algorithm which you can do in your head. For example, you could use parts of the domain name to map to a specific word from a list that you've memorized. But there is an infinite number of rules you can choose from so you don't lose any security.
  - shard 6y ago
    That depends on the type of threat being protected against. If the threat is a mass exfiltration of passwords, this method will probably work fine since nobody will bother trying to figure out that one weird trick to get this one person's passwords when there are a few million others to work on. If the threat is someone targeting you specifically, then you might need a better system.
atq2119 6y ago
Browsers have had built-in password stores for years now. Why not just use those?
- ComodoHacker 6y ago
  So let that one entity be your browser vendor? Also, the article says this product is primarily for enterprise customers, who need other features like sync across team and team access management.
  - atq2119 6y ago
    My browser already sees all of my (web) passwords anyway. Therefore, using the browser's built-in password management reduces the number of external entities I need to place my trust in. Though fair enough when it comes to enterprise features.

Just note them down in a book? I know, it sounds stupid, but nowadays it's a lot easier to keep a small booklet save than a digital file on a connected machine.

lmilcin 6y ago
No, it is not stupid. It is strange how people get blinded by technology and forget about oldest, most reliable methods. I have worked as a security officer at a credit card acquirer (basically, processing credit card transactions between terminal and the bank). The process to safeguard your PINs is extremely complex but at the very end relies on pieces of paper with passwords and key components written down, put in tamper evident envelopes and then into safes.
- jniedrauer 6y ago
  You're describing backups. The base derivation keys still have to exist in an HSM to be used. No one is opening a safe and hand-typing the BDK each time they need to issue a PIN encryption key.
  - lmilcin 6y ago
    It is not a backup. Backups are made just in case. In case of HSM keys, the HSM itself is built to loose those keys at the least pretense. It is also not possible to retrieve the keys. So whenever you want to provision a new HSM or even just move it couple centimeters (it looses keys when you try to move it) you have to go to the components written on paper. It is just like a password on a website -- you have to be entering it regularly. But once you enter the password you don't need to retype it for every HTTP request. Key components = password HSM = browser Message with PIN block = HTTP request

lmilcin 6y ago

I have couple of ways of dealing with the problem. -- Pen and paper? It is still a thing and cannot be stolen online. -- If you are afraid your family will access it without your knowledge, use tamper evident bag and a notepad to make notes of bag serial numbers. This prevents anybody from accessing it without your knowledge. -- Split the password into components so that even if somebody gets access to the piece of paper with the password they still can't log in. I make a note of the variable part of the password and remember a different prefixes/suffixes. I use different prefixes/suffixes for different classes of accounts. For most critical accounts I don't reuse anything. -- Use hardware (yubikeys) as second factor, to lessen pressure on the password. Unfortunately almost nobody implements these well. In most cases it is possible to turn off the second factor without presenting second factor which basically nullifies the value of it. If you use second factor on a site that implements it well, remember to have MULTIPLE copies of it. Keep it in triplicate, one with you, one in tamper evident bag and one offsite.

StavrosK 6y ago
Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.
- swiley 6y ago
  You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.
  - CarelessExpert 6y ago
    Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android + browser plugins + syncthing. The idea of storing my passwords in someone else's cloud gives me the heebie jeebies...

II2II 6y ago

In my case, the most critical passwords are memorized and are not stored in any other medium after the brief period that it takes to memorize it. Simply put, I saw a breach like this coming and I anticipate many more in the future. Simply put, password managers are too big of a target. As for the rest, a written record is sufficiently secure since most of those login credentials aren't protecting anything important. I also have a tendency to avoid services that require a login.

cryptica 6y ago

It's easy. Just come up with a secret rule and derive the passwords from that rule such that the password is different for each website/service.

scrollaway 6y ago
Then the passwords are not secret, the rule is. And figuring out a rule with a couple of examples is much easier than breaking into an encrypted, properly secured password vault. In case I'm losing you, here's a parallel: if I ask you to pick and remember a random number between 1 and 1 billion, the odds of me figuring it out are low. But if I ask you to pick and remember 200 numbers between 1 and 1 billion, you will likely come up with "a rule", and then if I get a couple of example numbers (in a "password leak"), i can probably figure it out. The numbers are no longer secret, it's the rule that is.
- edflsafoiewq 6y ago
  Generally the rule would be hash(master password ++ key).
  - scrollaway 6y ago
    Then you're just reimplementing a password manager... Badly.
    - cryptica 6y ago
      Well it could be your own secret hashing or concatenation algorithm which you can do in your head. For example, you could use parts of the domain name to map to a specific word from a list that you've memorized. But there is an infinite number of rules you can choose from so you don't lose any security.
- shard 6y ago
  That depends on the type of threat being protected against. If the threat is a mass exfiltration of passwords, this method will probably work fine since nobody will bother trying to figure out that one weird trick to get this one person's passwords when there are a few million others to work on. If the threat is someone targeting you specifically, then you might need a better system.

atq2119 6y ago

Browsers have had built-in password stores for years now. Why not just use those?

ComodoHacker 6y ago
So let that one entity be your browser vendor? Also, the article says this product is primarily for enterprise customers, who need other features like sync across team and team access management.
- atq2119 6y ago
  My browser already sees all of my (web) passwords anyway. Therefore, using the browser's built-in password management reduces the number of external entities I need to place my trust in. Though fair enough when it comes to enterprise features.