Hacker News Reader

Comment by mdemare | Hacker News Reader

The strategy is fine - the problem is that people don't use a random number generator. This is how you get a 3-word password with 54-bits of complexity (on a mac with a recent ruby):

  ruby -e 'puts File.read("/usr/share/dict/words").lines.sample(3).map(&:chomp).join(" ")'

"applewife holographic intercommonage"

Easier to remember than `rand(254)` => 16495714355860079

View on HN

Yeah super. Let me scale that for my bank, car loan, house loan, credit cards, FB, IG, Twitter, Email, HN, Coursera, EdX, Udacity, Udemy, Concur, forums, Netflix, LinkedIn, Paypal, Slac, Spotify, Hulu, AppleID, Reddit, Amazon, health insurance, college alumni page, Digital Ocean, WSJ, GoDaddy, hotel points, and airline miles sites.

I finally started using KeePassX so I could keep track of the insanely long and randomized passwords it creates across the same plethora of sites you've listed. I love using it, but there's no way in hell I can quickly update so many different credentials conveniently(e.g. update your password every 6 months or so? Just kill me now)

I've used password managers for about 15 years now. I just counted I have ~400 passwords saved, most of which I'm obviously not using and a large number for services that do not even exist any more.

As I can't be bothered to even check which ones to delete, I will definitely not be updating any of those.

One thing that works is putting the name of the service into part of your password for each site.

So like, Abzysbej@10netflix and Abzysbej@10hulu

And then one leak in plaintext compromises all of your accounts because a targeted attacker is presumably smart enough to understand what you did...

To make it a bit less conspicuous, take the third character (or something) from the service name and put it as the fifth character (or something) in an otherwise long random string. This will look like a random password... until someone gets two or more passwords made with this strategy, then it's pretty easy to find out the strategy.

How is any of this easier than using a password manager??

You only have to remember one password, the strategy is the same for all passwords, replace the fifth character (for example):

google: mojko2if6bibe78

youtube: mojku2if6bibe78

yahoo: mojkh2if6bibe78

Note that I don't advocate this strategy for high-security applications, but for throwaway accounts that you might want to access when not having access to your password manager it might be useful.

I should clarify, there should only be a pattern like that for the many frivolous services, and a different password for financial medical etc.

That's a lot of accounts and a lot of passwords. You'd probably want to use a password manager. These kinds of passwords still have the advantage of being easy to hold in short-term memory, so when your password manager is on a different device than the service you're trying to use, you can look it up once and type it in rather than having to look back and forth between the two for that 16-digit number.

I think that's his point. The strategy of memorable passwords is not viable. You still need a password manager. But I agree that spellable, pronounceable passwords are helpful when you need to type on in.

Hmmm. Have you considered closing some of those and regressing away from your online presence in order to solve your evident frustration with managing so many pwds? If I signed up for all that cra..stuff, I would close some. :)

Except some you can outsource everything to a password manager.

I think I remember just these passwords: my 2 banks (that keep my savings), stock broker, primary email a/c, AppleID, personal VPS. For these too I keep very personal hints (no one else can guess) in KeePass (just in case).

Master passwords for LastPass and KeePass are quite difficult and I don't keep its hint or anything anywhere. It's a risk I decided to take. On the downside I have not changed these two passwords in a long time.

Rest goes to LastPass (100s of them).

I'm not sure how big your word-list is, but my (wbritish) is:

  $ wc -l /usr/share/dict/words
  99156 /usr/share/dict/words

Sticking with Ruby:

  > Math.log(99156,2)*3
  => 49.79223735944021

That's some ways off from 54-bits, but you can bump it over 66 bits by using four words.

Second, from what I gather from [1],[2] and [3] - you should probably use SecureRandom for cryptographic/security purposes:

  $ ruby -e 'require "securerandom"; puts \
  File.read("/usr/share/dict/words").lines.sample(4, \
  random:SecureRandom).map(&:chomp).join(" ")'

  remorse's mountaineers said arrival's

[1] https://ruby-doc.org/core-2.4.1/Array.html#method-i-sample

[2] https://ruby-doc.org/core-2.4.1/Random.html

[3] https://ruby-doc.org/stdlib-2.4.1/libdoc/securerandom/rdoc/S...

That may not be too viable. My first try:

> ruby -e 'puts File.read("/usr/share/dict/words").lines.sample(3).map(&:chomp).join(" ")'

xanthopsin pollenite aquascutum

Reply on news.ycombinator.com