Hacker News Reader

Comment by rolfvandekrol | Hacker News Reader

The amount of possible alterations (practical alteration that people actually come up with) of a diceware passphrase is, I think, much lower than the possible values of a 6 figure number (which is what most two factor applications use). If you think hard, you'll come up with maybe 100 possible alterations. I wouldn't trust this scheme as my password manager. I use 1password, which feels a lot safer to me.

View on HN

Ironically, you're frequently safer with a written down password than you are a password that is stored on your computer.

For example, to get your password book, the attacker must have physical access to you. This immediately lowers the attack surface. Your passwords can't be sniffed out of your clipboard. Your passwords can't be brute-forced by someone who compromises by one of your accounts (even the account which stores the encrypted password vault). You can burn your password book to ensure secure deletion.

Yeah, a password manager is still probably better; even the OP acknowledges that. OTOH, how secure is your password to access that manager? How frequently do you rotate it? What happens when that password is compromised?

To be fair to the author, he does write the following at the end of the post:

> PS If you are planning to do this... please consider using a password manager first.

which shows that he is aware that this is only a second-choice solution.

As the author says multiple times, before you try this, please at least try to use a password manager.

Reply on news.ycombinator.com