4 ms·
I have no passwords. Don't get me wrong, I don't use a password manager either. Not a single one of them is truly portable, safe or secure. What if you lose al
by Aerbil313 3y ago
I have no passwords.
Don't get me wrong, I don't use a password manager either. Not a single one of them is truly portable, safe or secure. What if you lose all your electronics? All your belongings? Your house burns down in a fire? The cloud gets hacked? You have conflicting interests with US government and they kindly request your passwords from Apple? You have conflicting interests with any other country and they find and use the backdoors installed in US companies by US agencies?
I use an algorithmic password which is:
* Trivial to run in my head (I got used to it)
* Compliant with all silly password character requirements
* Has password rotation built in for apps/websites which require you to change your password every X monts
* Has a shorter version for apps/websites which have a password length limit of 20 chars
* Has a third easier-to-spell version for passwords I need to share with family and friends
* Completely ASCII
* Impossible to tell with bare eyes it's the password for amazon.com from the resulting password. It looks like randomly generated gibberish.
* Leaves the Caps Lock off (so that you won't try again and fail again when you fail once and the Caps Lock is on)
I only have an algorithm in my head. The downsides? It's a bit more slower to enter a password if I haven't entered it in a while. Still doesn't take more than 30 secs. And it can only be brute forced in a million years instead of a billion.
And yes, you need these features in your algorithmic password. It took me about a year of trial and error to get to this point.
- ishtanbul 3y agoCan you please explain this more?
- pil0u 3y agoInteresting. If say 3 passwords using that algorithm leaked, would it be possible to deduce the algorithm itself? Edit: what about digit-only password?
- Aerbil313 3y agoNo. Not without a proper examination by someone who knows historical cryptography techniques, those used before computers. I'd expect the only real threat to be an automated transformer AI solution actively looking for these types of algorithmic passwords, and one which already has access to a few of my passwords. Which is extremely unlikely given that no one uses algorithmic passwords. I was using a separate algorithm for more critical things, like my Google account but I deemed it unnecessary after some time because there is virtually no chance someone will crack it. Though I should admit I still didn't migrate all my passwords to the latest and safest specification of the algorithm. Only using digits limits the probabilities space drastically.
- pil0u 3y agoI won't come at you, for lack of time and expertise. I'm genuinely interested in that approach, but I'm probably too afraid to design an algorithm that would be vulnerable for reasons I couldn't imagine. For digit-only, I meant platforms that forces you that requirement - my bank does. What about MFA?
- Aerbil313 3y agoCurrently I use custom passwords which I write down in a single file for digit-only passwords. But while I was writing my top comment, an idea about converting letters in app/website name to digits and scrambling them came to me. Take a look for the algorithms: https://www.google.com/search?q=historical+cryptography+techniques https://www.google.com/search?q=historical+cryptography+tech... Choose one which you can run in your head, don't use it as-is, insert random chars at certain places, substitute some letters in the app name for others, make sure it looks like randomly generated, and you will be fine. I still use 2FA with Authenticator (on iPhone), fallback set as SMS. Only thing I need is my government issued ID to get a new SIM card if the current one burns.