Hacker News Reader

Comment by EdTechAndrew | Hacker News Reader

Question for security experts: Is this really that much more secure than a local only password manager, like KeePass? It is fun, but the inconvenience of it feels like its not worth the benefits.

View on HN

Also, wallets are commonly lost and stolen. And houses burn down and are burglarized.

Unless you plan on keeping your passwords in a fireproof safe, which isn’t exactly convenient—especially in our modern mobile world. In 2010, when this article was written, far fewer people did this much computing from a smartphone.

Times in the last 40 years that...

  My wallet has been stolen: 0
  My house has burned down: 0
  LastPass has been breached: 2+
  LastPass' browser extension has caused me headaches: 9000+

The piece of paper in wallet browser extension is even worse. No auto-fill or auto-update options at all and you've got to take care of your own backups and recovery.

More trustworthy than software that may or may not work, may or may not protect secrets, may or may not go for-profit in the future, etc.

Password managers make it so that you are utterly dependent on your password manager or you cannot login to anything. How do you get back online to discuss something if your computer burns in a fire, for example? Backups can alleviate this, but the paper is also a backup. Maybe do the triplicate thing?

I've considered using a password manager but there are too many times where I need to login to something from a machine that isn't mine, on a machine that I don't trust with storing secrets, or other circumstance. I simply don't want to be caught with my pants down and unable to login to something because my password manager isn't installed.

That's just strawman. I have my pwd database stored in the cloud and synced to all my devices. How do I get back online? I will use one of my other devices. And in an unlikely event that all of those devices get destroyed all at once I will just hit "Forgot password" button.

The problem here might be LastPass, not password managers.

This is like posting to HN that GoDaddy screwed you. It's nothing but a self tattle anymore.

The number of times gpg has failed to decrypt one of my "pass" entries: 0.

Yeah, I'm such a loser, right?

I didn't choose to use LastPass. It was foisted on me by my employer.

Oh come ON.

Nowhere NEAR as common, in terms of people affected, as "breaches due to crap companies/software promising safety and not delivering."

My laptop, phone, ISP, banking, medical & KeePass passwords are written on paper in a fireproof safe.. I also keep offline backups of my KeePass database.

I am not a security expert. But this method I think I could teach my aging parents. Password managers don't work with them, too confusing. Just a simple OAUTH dialog causes a 30 minute phone call with them.

I don't know about more secure, or even practical.. But when I use stuff like this it makes me feel sneaky and clandestine.

I don't think it is. I recommend using a password manager that supports hardware 2fa. One of the main issues with the proposed paper mechanism are that it doesn't support rotating passwords individually. Another is sites that share second and third characters would share a password.

Reply on news.ycombinator.com