4 ms·
First of all, this looks like an awesome and very well-thought-out implementation, and I'm sure it'll work well for some people! That said, I actually made som
by enoch_r 11y ago
First of all, this looks like an awesome and very well-thought-out implementation, and I'm sure it'll work well for some people!
That said, I actually made something very similar to this a while back. Now I use pass instead: http://www.passwordstore.org/ http://www.passwordstore.org/
The downsides I didn't think about, or didn't think would be as annoying as they were, until I started running into them in actual use:
- The big one: change your master password? You now have to change all of your passwords for every service you use.
- Weird restrictions on password length or allowed characters? Okay, the app gives you options to generate a password with the required parameters, perfect! When you actually use this you realize that that set of parameters is a state that must be stored somewhere. Possibly your brain ("okay, when I log into gmail, I select 'phrase', but logging into Bank of America I have to use 'long'... or was it 'medium'?). This does not scale.
- Need to change a password for a specific service? Again--this has a "site counter", that works... except now there's more state, and you need to remember to use "2" with "gmail" and "5" with "hn" and...
Of course, you could (and, didn't download to try, but it's possible the app does?) store those restrictions/site counters somewhere, but now you've lost the main benefit of doing this in the first place (stateless, nothing to sync). In the end, I decided that gpg encryption is secure enough for me.
- jonasvp 11y agoGreat summary! I've been using Master Password for a few months now and I'm generally happy with it. However, the points you mention pretty much force me to have a KeePass file for "those other passwords".
- nichochar 11y agoI have used this mechanism manually with a simple algorithm and a secret key + site name for a while... And all of the things you mention are exactly on point :) My solution has been to have 3 different techniques: - a very sofisticated master password + algorithm for very critical things - a secondary, less sofisticated for less important things - a dummy password that i use for silly stuff I keep an up to date list of applications of the second tier. The first tier is easy enough to remember since it's the critical apps. I also go with 2fa when I can.
- luke-stanley 11y ago2FA = Two Factor Authentication (like Google Authenticator)
- bpye 11y agoCurious, have you used pass on Windows or Android? I'm thinking about getting a YubiKey Neo and switching from KeePass to pass since then I can use a second factor as my GPG key.
- enoch_r 11y agoI haven't tried pass on Windows or Android, but I did write an (over-complicated, but it was partly for fun and I wanted to play with clojure/clojurescript) webserver exposing pass from a VPS: https://github.com/johnswanson/pass-server https://github.com/johnswanson/pass-server I shut down the Linode it was on a while back and haven't gotten around to putting it back up yet, but it worked pretty well for me.
- andrewstuart2 11y agoA few times I've used `pass | nc -l $SOME_PORT` and then navigated to my hostname:$SOME_PORT with my mobile browser (over some secure network of course). It's not the best solution but it works for the rare occasion I need to authenticate an app.