back

by codazoda·9y ago·view on hn ↗
Two options come to mind, neither perfect, but options.

1. Use a password pattern. Something like 8 random digits that you memorize and then part of the domain name or business name. Such as "goo" for google. Put them in whatever order you like. Now you've memorized one pattern but use a unique password everywhere.

2. Use a predictable algorithm instead of a password. Their are web based services for this. You enter the domain name and then "encode" it to a password. That is typically not reversible.

These fall down some when you have to change a password or when a system has requirements that don't match your password (like requiring a number or symbol). Other users will mention other limitations as well.

2 comments
I do #2 using master password app. https://ssl.masterpasswordapp.com
You made me curious so I tried this app. Unfortunately the UI is horendous. So far I tried the macOS, iOS, .jar and web version. Each version generates different passwords for the same site. This app has the most confusing UI I have seen in a long time, with each version being wildly different from the other. I still have no idea how to have multiple users for the same site, or even if setting the user makes a difference at all (seems not as it does not change the password). But most important: this app generates different passwords for the same input on different platforms. Kind of beats the purpose of having it in the first place.
That is an interesting idea. echo URL + password | sha/md5

Should be hard to crack and easy to remember.

Can anyone who actually knows this thing chime in?

That is an interesting idea. echo URL + password | sha/md5

There are 'stateless' password managers that work that way. It does not really protect against malware. If your user account is compromised by malware, what holds them from reading out your password and applying the same procedure to obtain password for interesting sites? You'll still be updating your password everywhere.

What you want is a second factor that uses a challenge-response mechanism with user interaction (e.g. U2F Yubikeys that require a finger press to start the challenge-response).

They can't. Prove me otherwise.

Even if they have plaintext password (which is often not case), this is just shasum. Feel free to guess which password (and which exactly scheme) I used to generate my password for news.ycombinator.com, if (of course it's now not like that :) it is:

bb05f766a74e6bf722136eaca97d9beb1fcc8f59d47c2d9e6eb1667d57c4cb82

You have now (after hacking whole hackernews db) access to my password ONLY for the hackersnews. Which was the original goal of the method: to use different passwords at different sites, which if compromised (password), do not reveal scheme used to generate it for different sites.

bb05f766a74e6bf722136eaca97d9beb1fcc8f59d47c2d9e6eb1667d57c4cb82

That's not the point. The malware would have access to your complete machine, possibly with root privileges, what holds them from reading your master password with a keylogger when you type it in?

It does not provide more security against trojans than a password manager.

You didnt read my reply nor the parent thread.

I was replying solely and only to the acusation that after revealing plain text password on one site (which was generated using said scheme) you disclose every one.

This is simply not true.

In addition (but I didnt address that), there is no single keychain/password store to steal by the trojan. I can use it anywhere, using only my head as a 'storage' machine.

The “password” in that command would be stored in your memory only, that's the benefit of this idea.
You'd have to enter it into your computer fairly frequently, and malware could capture it then.