Hacker News Reader

Comment by Whitespace | Hacker News Reader

This recently happened to me after my laptop and phone were stolen on vacation. Everything is in 1Password. I of course didn't have the recovery paper with me. I recently changed my iCloud password to be more secure, and luckily I remembered it. But I needed 2FA to log in still.

I had to go to an AT&T store, port my phone number to a different iPhone, restore from an iCloud backup using the SMS 2FA, and then I could finally log into 1Password for my passwords and MFA.

If I didn't have a memorable iCloud password this would have been impossible without the 1Password recovery paper.

Devices are often lost/stolen on vacation where the myriad layers of protection are extremely hard — if not impossible — to penetrate.

View on HN

This is why some of my most important accounts (iCloud, Google) are passwords that I've forced myself to memorize. I've been stuck in the chicken and egg quagmire before and it really sucks. iCloud is particularly bad especially on the phone because none of the popups have password manager support so you have to manually go look it up, navigate back to whatever prompted for the password, and re-trigger the dialog.

If you (the Royal ‘you’, I’m not having a go at you) have 1Password and you do not have a printed, sealed copy of your recovery steps safely hosted at a best friend or relative’s house then I think you’re bonkers.

It’s so easy. Print it out. Write your password on it. Put it in an envelope and seal it. Give it to someone – suffice to say you trust this person with your life – who doesn’t live next door (otherwise their house burnt down along with yours).

You never need do anything ever again, other than not change your master password.

>a memorable iCloud password

Serious question: Once you have this, why bother with a password manager? Why not just keep a password spreadsheet in iCloud?

A password manager mitigates other threats that a spreadsheet in iCloud Drive does not, such as a program just directly reading it and ruining your life. And, anyways, password managers give you auto fill which is a significant quality of life improvement.

A memorable password is not a bad password, if done right. I have a password for both my google account and Apple ID that's easy to type because when you're in device setup you can't auto fill and so random passwords are a huge pain

When I was doing IT ops for a company, we had a little program that generated 4 random common words and put a symbol between them (!.@#$%). Super easy to type and fairly easy to memorize, but according to every password checker also really hard to crack.

"Broth.Dogs.Run.Blue" is 10x easier to remember than "$#kdSk$SWE223" but 1000x times more secure. Probably more so, because you are less likely to have to write it down to remember it.

As joshstrange mentions above, iCloud password prompts don't support password managers, which is the main reason why I have a memorable one.

Password managers are more useful to me than a spreadsheet in iCloud. I don't see why having a memorable iCloud password implies I should get rid of a password manager.

Do you have a spreadsheet of passwords in a cloud account somewhere?

Password managers plus biometric auth mean I almost never even need to copy-paste a password, let alone type one. I just hit "fill" and it fills it in. For most of the services I use these days, I've never typed or manually pasted the password, ever, not even once.

Yeah, I have a few key passwords (email and password manager being the main ones) memorised, and also stored written on paper in a safe place. Password manager also explicitly doesn’t have 2FA enabled so I should always be able to access that so long as I have an internet connection.

Now that I think about it, I might need to rethink my 2FA strategy for email to ensure that’s also accessible.

For this reason on long trips I travel with a laminated recovery password inside the zip of a ‘secret pocket’ in a belt.

One nice thing about recovery passwords is you don't need to put the account name/email with it (you'll presumably remember that).

That reduces the risk of losing it a bit.

I've got several little USB drives with the recovery key on it, although at the moment I'm also trying to use Anki to memorize it...

Reply on news.ycombinator.com