Hacker News Reader

Comment by simias | Hacker News Reader

So by definition your password manager master key is weak? That's an interesting paradox!

I don't even have the ability to read my password manager's master key, since all passwords are encrypted with different AES keys, which is then encrypted with a private key I have no ability to read (only ask my smartcard to perform RSA on, if I can authenticate to it).

hunter2 is the password manager I wrote for this: https://chiselapp.com/user/rkeene/repository/hunter2/

This is an interesting concept for storing keys. I may end up using something similar in a proof-of-concept I've been thinking about.

What if you loose your smartcard ?

He could have an encrypted digital copy somewhere else

I don't keep my private key, in any format, accessible -- usually the private keys are generated on the card and never revealed.

hunter2 supports the concept of users, which are named public keys so I can share individual passwords with other users. One of those other users can be a different smartcard or a different person who can then authorized my new card.

It's remembering one password vs X, and it is pretty hard to remember in my case, almost 4 months into using this password and I still struggle to type it in correctly sometimes

Yeah I was just kidding, I see what the parent meant.

Now I use a hardware token (yubikey) to store my PGP key so I can use a relatively weak PIN code on it (since you need to have physical access to the device to use it and you only have 3 attempts before it locks up). It's a pretty good quality of life improvement.

> you only have 3 attempts before it locks up

Then you better don't use it when you're fatigued or drunk. I nearly locked my SIM card once by not realizing until the third attempt that my phone was asking for the SIM card PIN rather than my lockscreen PIN.

There's also an "admin PIN" that can be used to unlock the key if something goes wrong. It's more complicated than my regular PIN and I didn't memorize it so that should be enough as a defensive measure against drunk me.

Well, unless I'm silly enough to try and bruteforce that PIN as well, after 3 failures I'd be left with an expensive piece of plastic... Fortunately I'm rarely that drunk.

EDIT: Actually as the sibling comment points out you can still reset the token even if you mess up the admin PIN. So at least you won't "brick" your token completely.

Even if you mess that up, you can reset it, but it'll wipe. Then you restore from cold backup.

My password? Sure it's weak I guess. The keyfile? No.

Well, the password manager master key encrypts a local file, so an attacker must have access to your machine first. And it's only one password to remember, as opposed to a high-strength password for every single site one uses.

Reply on news.ycombinator.com