Hacker News Reader

Comment by viraptor | Hacker News Reader

Good idea in theory. Unfortunately every serious person doing programming / administration / ... will have at least 20 accounts on the internet (probably underestimated!: email, other email, HN, sourceforge, github, facebook, own pc, own pc admin, vps, stackoverflow, etc. etc.)

At some point it's not possible to remember them all anymore... You have a choice of storing them with master password (now I can get all of them in one file), using the same one, having a password scheme (like usualpwd_HN, usualpwd_gmail, ...) or ... ?

Edit: what I started doing is setting random password that I will not remember and just requesting a reset when I get logged out.

View on HN

...or... writing a simple script that given a key, generates you a password based on it.

I probably have 50+ passwords at least, and every one is different. I just run my little script with a "key" and it tells me the password.

And of course browsers remember them anyway.

  ./get_my_password.sh mygmail
  ./get_my_password.sh server_1_mysql_root

I think 1password etc do similar things though.

1password uses 128-bit AES, based on your master password. Intelligently, they didn't write their own encryption.

Of course, we wanted to avoid writing this code in the Agile Keychain and elected to use the OpenSSL function PKCS5_PBKDF2_HMAC_SHA1 to generate the keys. Key generation is simply too important a step to not rely directly on the experts. In order to thwart would-be attackers and strengthen the key, we elected to use 1000 iterations in the PBKDF2 algorithm.

http://help.agile.ws/1Password3/agile_keychain_design.html

I used a password manager, and I have a different password for every single service that I'm signed onto.

If you're using similar passwords for all the services you're signed onto, it's pure hypocrisy to turn around and criticise Rackspace for "poor security". The single point of failure is you.

You could use a password scheme for sites you don't really care much about and stronger separate passwords for important and often used sites.

I do this and it works out well and if you use the important sites enough you will and do remember your strong passwords but for the ones you don't you always can reset your password by email which isn't that inconvenient if you think about how often you are accessing the website that you cannot remember your password.

Reply on news.ycombinator.com