Hacker News Reader

Comment by phito | Hacker News Reader

Password managers are the most stupid thing, really? What better alternative do you propose?

Stop using passwords entirely. That's my dream alternative.

Password managers are stupid because the problem they solve is dumb. They act like fake users inputting passwords into little boxes.

I don't know how to solve that issue though. Some single-sign-on? Client certificates? Biometrics? I don't know.

Probably client certificates would be the best option.

Generate two random 32 length strings. For the sake of this example, let them be 2quvs7jriTXQK8sFv4LzBZRtSN9hqp9q and qFTNX4f5sduaLYShWx96EyZw9ZRNLmqY.

Designate the first to "heads" and the second to "tails". Every time you're prompted to login with a password, flip a coin and enter that designated password. If it fails, then enter the second password.

For those interested in basic cryptography, feel free to point out the major and obvious flaw in this approach.

So you would effectively have 2 passwords reused across all sites?

1. If any of that site is compromised, 50% of your sites will be quickly owned due to password reuse with same username.

2. If someone will get hold of two of your unencrypted strings, they own 100% of your accounts.

- You may solve #1 by creating new password for each site.

- You may solve #2 by encrypting the file.

Voila, you just created your own password manager.

Web3 is the solution to all our problems!... obviously not

But something I've seen is that is making mainstream using private and public keys. We have Client certificates but those are hard to create and use, and not really compatible with mobile.

I think a good workflow will be something similar to connecting to SSH, instead of a static password you sign a challenge with your key pair.

I have a few weeks thinking of replacing the social login (FB, Twt, OAuth) with wallet login https://github.com/amaurym/login-with-metamask-demo

One suitable option is to memorize an algorithm as a password:

Say, given a site, create a password as:

HardcodedChars+siteName+len(siteName)+symbolInKeyboardOf(lenSiteName)+len(TLD)*N+hardcodedChars

So gmail.com would be something like

Chad1Gmail5%9Foo@

And then use that algorithm for generating all passwords.

This was my strategy for some time, but I switched to using a proper password manager (Bitwarden). If your algorithm is discovered you're in as much trouble as if you used the same password across multiple sites.

> One suitable option is to memorize an algorithm as a password:

You lost 99% of people here.

What happens if siteName changes? What happens if you lose your memory?

Wait was it "TransferWise" or "Transferwise" or "Wise" or "wise" or "transferwise"?

I don't hate the idea, but what happens when you stumble upon a website that does not accept % in passwords, or needs less then 8 characters or one of the other random things that do exist? Then you have an algo for this, and a algo for that, you end up back at the same place.

Moreover, how does an algorithm handle password resets?

What happens if you lose the PostIT where you had your password?

What happens if you lose your KeePass file?

What happens if your password manager service goes out surprisingly, or gets hacked and someone deletes their DB?

What if, what if...!

It terms of authentication we have: * Things you know

* Things you have (physically)

* Things you are

We have abstracted a thing we know, passwords, to be managed. The alternative could be multiple things we have and things we are.

So a combination of:

* physical objects, such as keys, smart phones, smart cards, USB drives, and token devices.

* fingerprint scanning, palm scanning, facial recognition, retina scans, iris scans, and voice verification, etc.

Reply on news.ycombinator.com