Hacker News Reader

Comment by wereHamster | Hacker News Reader

I don't trust third parties to securely store my passwords. The problem with randomly generated passwords it that they are hard (impossible?) to memorize. Password squares help there, because they allow you to visually memorize the password by using a path inside a random character grid.

I recently created a website that generates a random 'password square'. It should display nicely on latest browsers (which support flexbox). You can optionally supply a seed if you want to reuse the same path but have it yield a different password.

https://caurea.org/passwd/ https://caurea.org/passwd/#seed

The website is intentially barebones, to allow you to print it out and store offline.

View on HN

> It should display nicely on latest browsers (which support flexbox)

So after years of telling people "Don't use table tags for layout", web devs have finally got that message... and they've started using layout tags for tables instead :(

In no way is that a table. It's a grid.

If you're memorizing a lot of passwords, you're doing it wrong. Use a password manager and memorize one, that no sites ever see. (In practice you'll probably want to memorize another one or two for important accounts and a login password.)

Using a password manager? You're doing it wrong.

Manage your passwords like this: change them frequently. Remember them. Never write them anywhere you don't intend to use them.

I tried to address that in the first sentence.

No decent password manager will expose your passwords to a third party. If syncing is supported, only passwords encrypted with your master password are sent over the network. AFAIK, that's how all the popular ones work.

FWIW, I use "pass", which is a short bash script that's a thin wrapper around gpg. If you can't trust that, I'm not sure how you can use a computer.

http://zx2c4.com/projects/password-store/

Btw, your password square generator isn't using a secure source of random numbers, which makes me highly doubtful.

> No decent password manager will expose your passwords to a third party.

Unless you are verifying the source and compiling yourself, your password manager IS a third party.

> FWIW, I use "pass", which is a short bash script that's a thin wrapper around gpg. If you can't trust that, I'm not sure how you can use a computer.

Sure, I probably trust GPG and the devs behind it. But unless you are downloading from them directly and verifying binaries, or building yourself from their source (and comparing source), you aren't really just trusting them, you're trusting the people that are distributing GPG to you. If the provider is a well respected linux distro, I probably trust it, but it's quite a bit less trust than the GPG devs themselves get. There's a lot more hands involved there and many more places for someone to inject some nefarious code, or just plain screw up[1].

I guess the real point is that "decent" in "decent password manager", or any security product for that matter, has higher bar than in many other industries, but this many not be common knowledge.

Edit: For that matter, I guess the only reason I trust GPG at all is that enough decentralized volunteers will look at it that coercing them all into keeping silent (or silencing them in another manner) about any backdoor they find is probably impossible (or at least requires enough effort as to make it unfeasible).

[1]: https://www.schneier.com/blog/archives/2008/05/random_number...

I agree with everything you said, but you're looking too closely at just the last link in a long chain. Yes, it's important to trust your password manager. I base that trust on my inspection of the short bash script and on the reputation of GPG and the Ubuntu distribution system. But 95% of the passwords stored in there are being pasted into chrome, which is a gigantically complex piece of code with hundreds of developers. They're passing through the selection buffer of Xorg, which is also quite a beast with many contributors over time. And of course I have to trust the Linux kernel! Not to mention the hardware it's all running on, which I'm sure has many critical parts manufactured in a country that harbors and probably sponsors people hacking into US companies and infrastructure.

Looking at the whole picture, using something like LastPass or 1Password in place of bash+gpg is only marginally less secure, and since non-techies are more likely to actually use them than some console-based thing, encouraging their use is a net win for security. Saying "you shouldn't trust a password manager that you haven't inspected line-by-line" is ultimately counter-productive. The people that have the most to gain from password managers can't even read code, and certainly couldn't spot a hidden side-channel.

You don't have to blindly trust a third party.

I have a KeePass which can generate random passwords. I trust that because it's open source, so I could look at what they're doing--and build it myself--if I wanted.

I store the db file in Dropbox, but I don't trust them either: my file is encrypted with both a unique password and a second key file which I've taken pains to only ever transmit by copying on removable media.

Reply on news.ycombinator.com