Hacker News Reader

Comment by sakisv | Hacker News Reader

That's very nice, well done!

For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so mechanically when I'm on my laptop, that I really struggle to remember it when I have to type it on a screen - to the point that I must go sit at a computer open a notepad, let muscle memory take over and then look at the screen to see what I typed /facepalm

Anyway, in all seriousness, while this is a scenario that happens very rarely, it still makes me wonder if it would be possible to do the pasdwordless login the other way, i.e. authenticate the phone using a trusted laptop (maybe a fingerprint enabled one)?

View on HN

Ha! I can definitely relate. Takes me 3-4 tries to get the password correct on mobile, and not so rarely I have to type it on the computer first.

I'm in exactly the same boat. Incapable of typing my master password on a mobile screen because it's just muscle memory.

I've had times where I've needed to get into my account in a hurry and had to find a POS terminal with a keyboard so I could activate the muscle memory.

i use a regular english sentence as my master password; seems to strike the right balance between not brute-forceable and easy to remember. am i missing some potential drawback to doing that?

One thing to consider is that you can infer your password structure by ear (e.g. how many times the space bar was used, any modifier keys), making dictionary attacks much scarier, especially if your threat model includes people in close proximity/public areas.

>> am i missing some potential drawback to doing that?

My work machines (government) check for "commonly used words" and will generally reject natural language even if squashed between punctuation marks. "P@ssword" would probably slip through, but "GodIHateRememberingAllTheseStupidPasswords!@#!@" doesn't.

I just have the master password saved in my browser. I realise this is probably sub-optimal for a lot of people but for my workflow (i.e. the kinds of passwords I put in BitWarden) it works out OK.

Reply on news.ycombinator.com