4 ms·

I frankly thing password managers are the most stupid thing. We fake users inputing text to input boxes and spend crazy time figuring out how to do that and ho

I frankly thing password managers are the most stupid thing. We fake users inputing text to input boxes and spend crazy time figuring out how to do that and how to get around various sites trying to block that, so the site can still pretend it’s actual user inputting the password. Plus the manager needs to work around arbitrary password rules. Plus they usually don’t work at OS level; so you still need to remember that stupid iTunes password, that stupid Windows password, that stupid Google password on Android login. Plus you still need random PINs in random banks and other systems. It’s better than memorizing, of course, and slightly better than writing it on paper somewhere (although that’s actually not that horrible honestly). It’s just, they feel like a patch-fix from 1990s to a problem from 1990s. I don’t want password manager. I wish I didn’t need password manager.

phito 5y ago
Password managers are the most stupid thing, really? What better alternative do you propose?
- xtracto 5y ago
  One suitable option is to memorize an algorithm as a password: Say, given a site, create a password as: HardcodedChars+siteName+len(siteName)+symbolInKeyboardOf(lenSiteName)+len(TLD)*N+hardcodedChars So gmail.com would be something like Chad1Gmail5%9Foo@ And then use that algorithm for generating all passwords.
  - udia 5y ago
    This was my strategy for some time, but I switched to using a proper password manager (Bitwarden). If your algorithm is discovered you're in as much trouble as if you used the same password across multiple sites.
  - sumedh 5y ago
    > One suitable option is to memorize an algorithm as a password: You lost 99% of people here.
  - dubcanada 5y ago
    What happens if siteName changes? What happens if you lose your memory? Wait was it "TransferWise" or "Transferwise" or "Wise" or "wise" or "transferwise"? I don't hate the idea, but what happens when you stumble upon a website that does not accept % in passwords, or needs less then 8 characters or one of the other random things that do exist? Then you have an algo for this, and a algo for that, you end up back at the same place.
    - panda-giddiness 5y ago
      Moreover, how does an algorithm handle password resets?
    - xtracto 5y ago
      What happens if you lose the PostIT where you had your password? What happens if you lose your KeePass file? What happens if your password manager service goes out surprisingly, or gets hacked and someone deletes their DB? What if, what if...!
- shp0ngle 5y ago
  Stop using passwords entirely. That's my dream alternative. Password managers are stupid because the problem they solve is dumb. They act like fake users inputting passwords into little boxes. I don't know how to solve that issue though. Some single-sign-on? Client certificates? Biometrics? I don't know. Probably client certificates would be the best option.
- eaplmx 5y ago
  Web3 is the solution to all our problems!... obviously not But something I've seen is that is making mainstream using private and public keys. We have Client certificates but those are hard to create and use, and not really compatible with mobile. I think a good workflow will be something similar to connecting to SSH, instead of a static password you sign a challenge with your key pair. I have a few weeks thinking of replacing the social login (FB, Twt, OAuth) with wallet login https://github.com/amaurym/login-with-metamask-demo https://github.com/amaurym/login-with-metamask-demo
- yifanl 5y ago
  Generate two random 32 length strings. For the sake of this example, let them be 2quvs7jriTXQK8sFv4LzBZRtSN9hqp9q and qFTNX4f5sduaLYShWx96EyZw9ZRNLmqY. Designate the first to "heads" and the second to "tails". Every time you're prompted to login with a password, flip a coin and enter that designated password. If it fails, then enter the second password. For those interested in basic cryptography, feel free to point out the major and obvious flaw in this approach.
  - miskin 5y ago
    So you would effectively have 2 passwords reused across all sites? 1. If any of that site is compromised, 50% of your sites will be quickly owned due to password reuse with same username. 2. If someone will get hold of two of your unencrypted strings, they own 100% of your accounts. - You may solve #1 by creating new password for each site. - You may solve #2 by encrypting the file. Voila, you just created your own password manager.
- deleted 5y ago
  [deleted]
- aiisjustanif 5y ago
  It terms of authentication we have: * Things you know * Things you have (physically) * Things you are We have abstracted a thing we know, passwords, to be managed. The alternative could be multiple things we have and things we are. So a combination of: * physical objects, such as keys, smart phones, smart cards, USB drives, and token devices. * fingerprint scanning, palm scanning, facial recognition, retina scans, iris scans, and voice verification, etc.
fraktl 5y ago
IggleSniggle 5y ago
There are a few auth schemes that cut out of the middleman of the password while providing the same level of security. SQRL and Microsoft Passwordless Login both come to mind.
the_cramer 5y ago
I agree partially. Passwords are posing an indirect security issue. But in my opinion this is more due to the handling of those by humans. So many different places where you can login, you need 20+ passwords. These should all be very long so that they are deemed secure enough. Remembering this is a chore leading to one of two things - the user tends to create short passwords or mneonics that only change a few letters/numbers per password - the user will use a password manager, completely giving up control in case of a disastrous failure (e.g. data deletion) and having potentially finicky setups. There should be better options for the broad usership than passwords, but password managers are imho a good solution for today.

phito 5y ago

Password managers are the most stupid thing, really? What better alternative do you propose?

xtracto 5y ago
One suitable option is to memorize an algorithm as a password: Say, given a site, create a password as: HardcodedChars+siteName+len(siteName)+symbolInKeyboardOf(lenSiteName)+len(TLD)*N+hardcodedChars So gmail.com would be something like Chad1Gmail5%9Foo@ And then use that algorithm for generating all passwords.
- udia 5y ago
  This was my strategy for some time, but I switched to using a proper password manager (Bitwarden). If your algorithm is discovered you're in as much trouble as if you used the same password across multiple sites.
- sumedh 5y ago
  > One suitable option is to memorize an algorithm as a password: You lost 99% of people here.
- dubcanada 5y ago
  What happens if siteName changes? What happens if you lose your memory? Wait was it "TransferWise" or "Transferwise" or "Wise" or "wise" or "transferwise"? I don't hate the idea, but what happens when you stumble upon a website that does not accept % in passwords, or needs less then 8 characters or one of the other random things that do exist? Then you have an algo for this, and a algo for that, you end up back at the same place.
  - panda-giddiness 5y ago
    Moreover, how does an algorithm handle password resets?
  - xtracto 5y ago
    What happens if you lose the PostIT where you had your password? What happens if you lose your KeePass file? What happens if your password manager service goes out surprisingly, or gets hacked and someone deletes their DB? What if, what if...!
shp0ngle 5y ago
Stop using passwords entirely. That's my dream alternative. Password managers are stupid because the problem they solve is dumb. They act like fake users inputting passwords into little boxes. I don't know how to solve that issue though. Some single-sign-on? Client certificates? Biometrics? I don't know. Probably client certificates would be the best option.
eaplmx 5y ago
Web3 is the solution to all our problems!... obviously not But something I've seen is that is making mainstream using private and public keys. We have Client certificates but those are hard to create and use, and not really compatible with mobile. I think a good workflow will be something similar to connecting to SSH, instead of a static password you sign a challenge with your key pair. I have a few weeks thinking of replacing the social login (FB, Twt, OAuth) with wallet login https://github.com/amaurym/login-with-metamask-demo https://github.com/amaurym/login-with-metamask-demo
yifanl 5y ago
Generate two random 32 length strings. For the sake of this example, let them be 2quvs7jriTXQK8sFv4LzBZRtSN9hqp9q and qFTNX4f5sduaLYShWx96EyZw9ZRNLmqY. Designate the first to "heads" and the second to "tails". Every time you're prompted to login with a password, flip a coin and enter that designated password. If it fails, then enter the second password. For those interested in basic cryptography, feel free to point out the major and obvious flaw in this approach.
- miskin 5y ago
  So you would effectively have 2 passwords reused across all sites? 1. If any of that site is compromised, 50% of your sites will be quickly owned due to password reuse with same username. 2. If someone will get hold of two of your unencrypted strings, they own 100% of your accounts. - You may solve #1 by creating new password for each site. - You may solve #2 by encrypting the file. Voila, you just created your own password manager.
deleted 5y ago
[deleted]
aiisjustanif 5y ago
It terms of authentication we have: * Things you know * Things you have (physically) * Things you are We have abstracted a thing we know, passwords, to be managed. The alternative could be multiple things we have and things we are. So a combination of: * physical objects, such as keys, smart phones, smart cards, USB drives, and token devices. * fingerprint scanning, palm scanning, facial recognition, retina scans, iris scans, and voice verification, etc.

fraktl 5y ago

IggleSniggle 5y ago

There are a few auth schemes that cut out of the middleman of the password while providing the same level of security. SQRL and Microsoft Passwordless Login both come to mind.

the_cramer 5y ago

I agree partially. Passwords are posing an indirect security issue. But in my opinion this is more due to the handling of those by humans. So many different places where you can login, you need 20+ passwords. These should all be very long so that they are deemed secure enough. Remembering this is a chore leading to one of two things - the user tends to create short passwords or mneonics that only change a few letters/numbers per password - the user will use a password manager, completely giving up control in case of a disastrous failure (e.g. data deletion) and having potentially finicky setups. There should be better options for the broad usership than passwords, but password managers are imho a good solution for today.