Hacker News Reader

Comment by shp0ngle | Hacker News Reader

I frankly thing password managers are the most stupid thing.

We fake users inputing text to input boxes and spend crazy time figuring out how to do that and how to get around various sites trying to block that, so the site can still pretend it’s actual user inputting the password. Plus the manager needs to work around arbitrary password rules. Plus they usually don’t work at OS level; so you still need to remember that stupid iTunes password, that stupid Windows password, that stupid Google password on Android login. Plus you still need random PINs in random banks and other systems.

It’s better than memorizing, of course, and slightly better than writing it on paper somewhere (although that’s actually not that horrible honestly).

It’s just, they feel like a patch-fix from 1990s to a problem from 1990s.

I don’t want password manager. I wish I didn’t need password manager.

View on HN

I agree partially. Passwords are posing an indirect security issue. But in my opinion this is more due to the handling of those by humans. So many different places where you can login, you need 20+ passwords. These should all be very long so that they are deemed secure enough.

Remembering this is a chore leading to one of two things - the user tends to create short passwords or mneonics that only change a few letters/numbers per password - the user will use a password manager, completely giving up control in case of a disastrous failure (e.g. data deletion) and having potentially finicky setups.

There should be better options for the broad usership than passwords, but password managers are imho a good solution for today.

Password managers are the most stupid thing, really? What better alternative do you propose?

Stop using passwords entirely. That's my dream alternative.

Password managers are stupid because the problem they solve is dumb. They act like fake users inputting passwords into little boxes.

I don't know how to solve that issue though. Some single-sign-on? Client certificates? Biometrics? I don't know.

Probably client certificates would be the best option.

Generate two random 32 length strings. For the sake of this example, let them be 2quvs7jriTXQK8sFv4LzBZRtSN9hqp9q and qFTNX4f5sduaLYShWx96EyZw9ZRNLmqY.

Designate the first to "heads" and the second to "tails". Every time you're prompted to login with a password, flip a coin and enter that designated password. If it fails, then enter the second password.

For those interested in basic cryptography, feel free to point out the major and obvious flaw in this approach.

So you would effectively have 2 passwords reused across all sites?

1. If any of that site is compromised, 50% of your sites will be quickly owned due to password reuse with same username.

2. If someone will get hold of two of your unencrypted strings, they own 100% of your accounts.

- You may solve #1 by creating new password for each site.

- You may solve #2 by encrypting the file.

Voila, you just created your own password manager.

Web3 is the solution to all our problems!... obviously not

But something I've seen is that is making mainstream using private and public keys. We have Client certificates but those are hard to create and use, and not really compatible with mobile.

I think a good workflow will be something similar to connecting to SSH, instead of a static password you sign a challenge with your key pair.

I have a few weeks thinking of replacing the social login (FB, Twt, OAuth) with wallet login https://github.com/amaurym/login-with-metamask-demo

One suitable option is to memorize an algorithm as a password:

Say, given a site, create a password as:

HardcodedChars+siteName+len(siteName)+symbolInKeyboardOf(lenSiteName)+len(TLD)*N+hardcodedChars

So gmail.com would be something like

Chad1Gmail5%9Foo@

And then use that algorithm for generating all passwords.

What happens if siteName changes? What happens if you lose your memory?

Wait was it "TransferWise" or "Transferwise" or "Wise" or "wise" or "transferwise"?

I don't hate the idea, but what happens when you stumble upon a website that does not accept % in passwords, or needs less then 8 characters or one of the other random things that do exist? Then you have an algo for this, and a algo for that, you end up back at the same place.

Moreover, how does an algorithm handle password resets?

What happens if you lose the PostIT where you had your password?

What happens if you lose your KeePass file?

What happens if your password manager service goes out surprisingly, or gets hacked and someone deletes their DB?

What if, what if...!

This was my strategy for some time, but I switched to using a proper password manager (Bitwarden). If your algorithm is discovered you're in as much trouble as if you used the same password across multiple sites.

> One suitable option is to memorize an algorithm as a password:

You lost 99% of people here.

It terms of authentication we have: * Things you know

* Things you have (physically)

* Things you are

We have abstracted a thing we know, passwords, to be managed. The alternative could be multiple things we have and things we are.

So a combination of:

* physical objects, such as keys, smart phones, smart cards, USB drives, and token devices.

* fingerprint scanning, palm scanning, facial recognition, retina scans, iris scans, and voice verification, etc.

There are a few auth schemes that cut out of the middleman of the password while providing the same level of security. SQRL and Microsoft Passwordless Login both come to mind.

Reply on news.ycombinator.com