Hacker News Reader

Comment by atemerev | Hacker News Reader

My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced.

But I have a good memory and I trust it much more than my ability to keep things organized and make routine backups. It's easy for me to generate more or less secure passwords that I can memorize, like:

shrebangodiKe24+ binarKedonado!3297 Miregofinar--0009

etc.

Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore.

Then, I'll be screwed.

View on HN

> My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced.

Dropbox with KeepPass on Windows / KeePassX on Mac / MiniKeepPass on iOS works beautifully for me.

And KeePassX on Linux / KeePassDroid on Android. It's simple and works.

The biggest issue is that the passwords are usually copied via the clipboard, so any program accessing the clipboard could copy your passwords. It's of course up to your own assessment whether this is a problem worth consideration or not.

Consider using Keepass2Android rather than KeePassDroid. Instead of using the clipboard to transfer passwords, it provides an input method (a soft keyboard) that will type your passwords to your applications.

Thanks for the tip, I'll try it out!

Any password manager worth considering these days can sync across multiple computers given your master password.

Or you can just sync your encrypted password database over ownCloud or Syncthing, or whatever.

I've started to use a stateless password management scheme for that purpose: https://github.com/majewsky/pwget

I've tried this (or similar, own implementation), but got stock on weird requirements that some services imposed. In about 50% of cases, I had to modify generated password anyway (usually make it shorter). So instead of remembering password, I had to remember what restriction which service had.

Services should publish, in a computer-readable format, what the password requirements are.

Unfortunately many places consider this information sensitive and protect it fiercely.

> But I have a good memory and I trust it much more

Note that "a good memory" doesn't "scale" or remain constant over time. Plus more importantly you are assuming that something minor or major won't happen to you where for some reason you aren't able to remember things very clearly like you thought you would be able to.

”Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore.”

I don’t think you need to worry about that. See https://news.ycombinator.com/item?id=3140898

I use passwordstore.org's pass... which just syncs all the passwords via git (and they are encrypted with gpg). So I have redundancy/backup/versioning and the rest is just seperate (gpg'd) textfiles.

Have we proven that password managers are safe? It's worth for black hats to spend as much money to break a password manager as the most expensive secret stored in it. If most of the secrets of the world are stored in there, ...

I would recommend something like https://getvau.lt

Generate your passwords with a simple algorithm with a servicename and a keyphrase. Works really well.

I think this approach is better for your mom than for your average developer. I use LastPass and it continues to be difficult even for me to use, less savvy people wouldn't have a hope.

I'm also a Lastpass user, and while the service is near to flawless, I keep thinking that the UI is really bad. I wish they could work on that.

Yeah. It's slow, and just plain badly designed in places - crucial interactions hidden behind icon-only menus etc. I really hope they sort it out one day.

How is it difficult? I trust the security settings on my laptop, so I'm always logged in on my main browser. The process is as simple as entering the website and clicking on log in. When I register to something new, I just click on "save password". I generate passwords using Alt+G.

Comparing this to not using password managers, (in my opinion) I would say that LastPass is both easier and safer alternative than not using one.

Reply on news.ycombinator.com