5 ms·
Password managers are the most stupid thing, really? What better alternative do you propose?
by phito 5y ago
Password managers are the most stupid thing, really? What better alternative do you propose?
- xtracto 5y agoOne suitable option is to memorize an algorithm as a password: Say, given a site, create a password as: HardcodedChars+siteName+len(siteName)+symbolInKeyboardOf(lenSiteName)+len(TLD)*N+hardcodedChars So gmail.com would be something like Chad1Gmail5%9Foo@ And then use that algorithm for generating all passwords.
- udia 5y agoThis was my strategy for some time, but I switched to using a proper password manager (Bitwarden). If your algorithm is discovered you're in as much trouble as if you used the same password across multiple sites.
- sumedh 5y ago> One suitable option is to memorize an algorithm as a password: You lost 99% of people here.
- dubcanada 5y agoWhat happens if siteName changes? What happens if you lose your memory? Wait was it "TransferWise" or "Transferwise" or "Wise" or "wise" or "transferwise"? I don't hate the idea, but what happens when you stumble upon a website that does not accept % in passwords, or needs less then 8 characters or one of the other random things that do exist? Then you have an algo for this, and a algo for that, you end up back at the same place.
- panda-giddiness 5y agoMoreover, how does an algorithm handle password resets?
- xtracto 5y agoWhat happens if you lose the PostIT where you had your password? What happens if you lose your KeePass file? What happens if your password manager service goes out surprisingly, or gets hacked and someone deletes their DB? What if, what if...!
- shp0ngle 5y agoStop using passwords entirely. That's my dream alternative. Password managers are stupid because the problem they solve is dumb. They act like fake users inputting passwords into little boxes. I don't know how to solve that issue though. Some single-sign-on? Client certificates? Biometrics? I don't know. Probably client certificates would be the best option.
- eaplmx 5y agoWeb3 is the solution to all our problems!... obviously not But something I've seen is that is making mainstream using private and public keys. We have Client certificates but those are hard to create and use, and not really compatible with mobile. I think a good workflow will be something similar to connecting to SSH, instead of a static password you sign a challenge with your key pair. I have a few weeks thinking of replacing the social login (FB, Twt, OAuth) with wallet login https://github.com/amaurym/login-with-metamask-demo https://github.com/amaurym/login-with-metamask-demo
- yifanl 5y agoGenerate two random 32 length strings. For the sake of this example, let them be 2quvs7jriTXQK8sFv4LzBZRtSN9hqp9q and qFTNX4f5sduaLYShWx96EyZw9ZRNLmqY. Designate the first to "heads" and the second to "tails". Every time you're prompted to login with a password, flip a coin and enter that designated password. If it fails, then enter the second password. For those interested in basic cryptography, feel free to point out the major and obvious flaw in this approach.
- miskin 5y agoSo you would effectively have 2 passwords reused across all sites? 1. If any of that site is compromised, 50% of your sites will be quickly owned due to password reuse with same username. 2. If someone will get hold of two of your unencrypted strings, they own 100% of your accounts. - You may solve #1 by creating new password for each site. - You may solve #2 by encrypting the file. Voila, you just created your own password manager.
- deleted 5y ago[deleted]
- aiisjustanif 5y agoIt terms of authentication we have: * Things you know * Things you have (physically) * Things you are We have abstracted a thing we know, passwords, to be managed. The alternative could be multiple things we have and things we are. So a combination of: * physical objects, such as keys, smart phones, smart cards, USB drives, and token devices. * fingerprint scanning, palm scanning, facial recognition, retina scans, iris scans, and voice verification, etc.