Item — HN Reader

Always going to be a security/convenience tradeoff to some extent. If you expect to be targeted by The Baddies (tm), you want to tradeoff convenience for security. Spend some time every day memorizing long random strings and hope you never get hacked using the Wrench method[0].

If you're not expecting to be specifically targeted, then "modify a single password per service" can be surprisingly secure. Don't just add "tw" "fb", but memorize a more complicated algorithm that's not obvious from inspecting two or three leaked passwords. e.g. Basic Caesar Cipher on the odd characters of the passwords using some part of the service name (fb, tw) as a key. Memorize a single algorithm that you can do mentally. Use something completely different for primary accounts (probably bank + main email that allows you to reset other accounts' passwords).

Some people will disagree and say "just use a secure password manager", but there is a valid argument that managers are not necessarily the best solution, depending on your use case.

[0] https://xkcd.com/538/

1 comments

> there is a valid argument that managers are not necessarily the best solution

What is that argument?

"Depending on your usecase" - e.g. you use many devices, need your passwords on all of them, and don't trust any of the current password managers to do their job (which is valid due to the many breaches and vulns).

Is the reality that your home-grown solution is genuinely going to be more secure than one of those current password managers? I doubt it.

However, I agree that for some people existing password managers seem either too complicated (KeePass) or expensive (1Password). In that case, I recommend:

1. Generate a password randomly using a 'diceware' type methodology

2. Use a standard prefix in front of all your passwords.

3. Write the password without the prefix in a notebook that you carry everywhere.

It's still not as good as 1Password because the passwords are not encrypted. But it's better than using a predictable algorithm that you have to remember. And of course, it's better than the system this often replaces - using the same 8 character password everywhere.

But I still strongly recommend paying for 1Password. How much do you pay for a padlock for your bike, or a burglar alarm for your house?

I never claimed it was more secure than a password manager. Just 'surprisingly' secure. You get something easy to remember with a lot of entropy that's difficult even for someone targeting you to exploit and which mitigates against the more common attack of cracking passwords en-masse from a leak and retrying them.

Yes, it has its own attack vectors, but they don't include things like ads stealing your info from your password manager [0] and apps stealing your passwords from your clipboard [1], both of which are legitimate reasons why you might want an alternative to a password manager.

"home-grown solution" has very negative connotations in infosec and rightfully so. I don't like seeing it in these kind of contexts as it blurs an important distinction between "Don't write your own random number generator if you're creating an app like Signal" (don't do it) vs "Find a solution to deal something as shitty as passwords in a way that works for you" (do it).

Your recommended method might also suit some people better (e.g. people who already carry a notebook around everywhere and guard it carefully).

There are no silver bullets out there. Work out what your needs are and then find a reasonable solution. It might be a password manager. It might not be.

[0] https://www.theverge.com/2017/12/30/16829804/browser-passwor...

[1] https://arstechnica.com/information-technology/2014/11/using...