Hacker News Reader

Comment by sarciszewski | Hacker News Reader

My rule of thumb is to go for 128 bits of entropy:

    * If they allow all printable ASCII chars, that means
      128 / lg(94) = about 20 characters
    * If they only allow alphanumeric,
      128 / lg(62) = about 22 characters

If the site doesn't let me use a password > 20 characters, I don't sign up.

I also use a password manager, so all my passwords are randomly generated.

My master password? 64 characters of line noise I memorized years ago. ;)

Also:

https://defuse.ca/password-policy-hall-of-shame.htm

View on HN

So you don't use online banking at all?

Clearly you can't rotate your 64 characters of line noise effectively. I'm in a similar situation with my master password.

Does anyone know the security implications of this?

>I also use a password manager, so all my passwords are randomly generated.

Any recommendations?

Key points being security and cross platform accessibility.

https://www.zetetic.net/strip/ is on iOS, Android, Windows and Mac.

I've been using LastPass, it's been pretty solid. It's not the most polished thing in the world but it works well.

And InfoSec Taylor Swift uses it. https://twitter.com/SwiftOnSecurity/status/58655626893814169...

1password has been great for me. Its browser extension is so-so for IE, but great in Firefox and Safari. The iOS app is top-notch.

I use pass - http://www.passwordstore.org/

Another vote for pass. It doesn't integrate into other applications, but I don't mind that. It also doesn't sync, but it does create a git repo by default, so syncing isn't hard to set up yourself.

KeePass

Windows: http://keepass.info/download.html

Mac/Linux: https://www.keepassx.org/news/2014/04/433

iOS: https://itunes.apple.com/en/app/minikeepass-secure-password/...

And KeePassDroid on Android... it isn't pretty, but it works.

It's more important to choose to go from no password manager (and most likely less secure passwords) to using a password manager. Whether you use LastPass, 1Password, Dashlane, etc is more personal preference.

I've been using Dashlane http://dashlane.com for the past year and it works great across all browsers, iOS, Android, etc. Similar to other services it gives you a "security score" across all passwords to let you know if you're using insecure or repeat passwords and also reminds you to change your password when a service has been hacked.

I remember reading a paper evaluating the security of several password managers. As I recall PasswordSafe was rated strongest, followed by KeePass. I used to use PasswordSafe but switched to KeePass some time ago. Now I'm thinking about switching back. I'll see if I can find a citation for you.

It's always good to have scientific backup for http://www.schneierfacts.com/ :-)

I think I read this one, which evaluates the PasswordSafe database format as the strongest (but does not say anything about the program itself): http://www.6nelweb.com/bio/papers/pwvault-ESORICS12-ext.pdf

That's the one! Thanks!

I'm still using KeePass because I like the program a lot more than PasswordSafe, which is a little clunky. There's a KeePass implementation for iPhone, too. Those two things have kept me using it.

KeePass is open source, cross platform and free. I have used it for 4 years.

Make the leap to a password manager. I recommend Keepass, it can run on Windows/Linux, there are a number of compatible alternatives, you can export your database if you don't like Keepass, chromeIPass/PassIFox make browsing the web a breeze.

Reply on news.ycombinator.com