Hacker News Reader

Comment by tnb234 | Hacker News Reader

I still think the best possible practice is to use a password manager. I've been using one for a couple years I haven't ran into any issues so far. My passwords are long, complex,with symbols and unique. I use the phrase trick for the master password.

View on HN

Importantly, your password manager file can stay on your device, not in a network-connected database that can be hacked, downloaded, and brute forced. Having millions of targets in one place is tempting, your personal files aren't.

I use Keepass, I store the databases on Dropbox, I memorize the passphrases, and I store their private keys on a thumbdrive.

I do worry about someone analyzing each and every change to the database for some kind of information leak, but I also change the compound key every 6 months which should help.

One thing keeping me from using a password manager as a comprehensive solution is my Chromebook. I have to manually sign in every morning when I open it up, and I can't use a password manager on the sign-in screen.

Okay, so... memorize two strong passwords instead of one. Possible?... :)

Setting aside your incredibly patronizing tone, this is actually kind of important. My google account is by far my most important account, and I already have it connected to several other accounts such as Goodreads, Stack Exchange, and others.

Yes, I've backed things up, saved my contacts, etc. But insofar as a password manager is supposed to be a comprehensive solution, it's a solution that forces people to choose between their Chromebook and their password manager.

I wasn't trying to be patronizing; I'm in more or less the same boat.

My Google account has a strong-entropy, memorized password. So does my password manager.

That has covered all my usage cases, anyways.

Reply on news.ycombinator.com