Ask HN: Does anyone use an alternative to a password manager?

[BinaryIdiot]

As time goes on I find myself, both in my professional and my personal life, adding more and more usernames and passwords I need to remember. I have over a 100 accounts I need to keep track of and access typically access at a whim.

Since it's insecure to both use the same password over and over or to modify a single password per service (e.g. appending "fb" or "tw" etc to a password when using a different service) I have found that a password manager is literally the only thing working for me.

However, as break-ins become more and more frequent, I am concerned that my single point of failure, my password manager, could become compromised. I mean it seems almost inevitable, right? An attacker wouldn't even need to compromise the service or app you're using but your phone instead to gather the same data.

So I'm curious to those of you who use something other than a typically password manager: what do you use and has it been successful or a pain?

[ohthehugemanate]

I am shocked to see a tech literate audience recommending a single algorithm based password. This is pretty basic stuff. Minimize attack surface!

With a password manager, your attack surface is your email, and the password to the manager. You can focus your efforts on securing those two things with 2fa, a hardware device, etc. Every other password can be extremely difficult, and only grant access to an individual service.

Compare it to an algorithm, where your attack surface is "every service." If one password is compromised, they all are. Then you have to change them all manually, and remember what's been changed, when.

In an age of great open source options like bitwarden, Keepass, and unix pass, there's no excuse for using an algorithm anymore.

[alangpierce]

> If one password is compromised, they all are.

The point of an algorithm as opposed to a single shared password is that this isn't true. With a basic algorithm, you can avoid automated attacks based on password dumps. With a more complex algorithm, even a determined attacker targeting you would have a really hard time figuring it out. Regardless, it probably would need to be a few passwords, not just one. Also, any good web service will implement rate limiting and other protective measures, so brute force attacks are unlikely to work.

The counterargument to "minimize attack surface" is "avoid single points of failure", and that includes both attacks and accidentally losing access to all of your passwords. What if I drop my phone and/or laptop in a lake? What if I forget my master password somehow? What if someone installs a keylogger and gets my master password? What if I accidentally install a malware version of the password manager client that steals my password?

Not that I necessarily think that an algorithm is better overall than a password manager, but I think it's not as obvious a decision as you're claiming.

[kinkrtyavimoodh]

It doesn't make sense to talk of an attack surface without talking about the kind of attack.

Unless you are a high value target, there is a pretty good chance no one is sitting specifically bruteforcing your passwords.

Your biggest source of attack is then a password dump, where you are one of the many millions compromised and now your other accounts (if you reused the same password) are now vulnerable to automated attacks. Even in this case, no one is going to sit around trying to figure out your password algorithm.

Even when it comes to compromised accounts, not all of them are equal. For most people, their primary email, banking and social media accounts are paramount, because they are fundamentally linked to their identity (I would be horrified if my FB or GMail were to be compromised, but only mildly miffed if my etsy account where I have made one purchase were to be compromised).

All in all, it seems that the most important thing to do is to never reuse a password for ANY of your primary accounts (email, finance, social media, other forms of identity). Ideally for those, don't use an algorithm either. And set up 2FA for these.

And for other accounts, preferably never reuse passwords. Whether you use a password manager to manage them or an algorithm should not make too much of a material difference.

[bradknowles]

Algorithmic password generation from a single master password works fine up to the point where it doesn’t.

What happens when you run into a site that won’t accept your algorithmic generated passwords?

Do you fall back to a traditional password manager?

If so, then you’ve just increased your attack surface area by an order of magnitude.

What happens when you need to change your master password because of a compromise, and now all of your passwords have to change at the same time?

[ecesena]

I think you're assuming that the algorithm must be reversible, but I don't see why. For example, hash(site|strong_master_password) isn't reversible under reasonable assumptions.

If the algorithm is not reversible, "one password is compromised, they all are" isn't true. Only if the master password is compromised, then all your passwords are (but this is exactly the same with any password manager.)

The one thing that personally I don't like about vaults is availability of my passwords. You need your password manager (i.e. the app) to get your passwords. I've had multiple situations, typically when traveling, where I didn't have access to my devices, and thus I didn't have the app.

[arunc]

Absolutely! I've been using Keepass soccer 2011 and I would highly recommend it to anyone. It's available for Windows, Android (Keepass2Android), Ubuntu Linux (Keepass2) and I have the encrypted database synchronised via Google. Seamless setup and operation. A must have in this modern age.

[ythn]

> Compare it to an algorithm, where your attack surface is "every service." If one password is compromised, they all are.

My password for Amazon is "f3cfcb6ZUZ^". What's my algorithm?

[nullterminator]

I use Linux, Windows, and Android. I decided on Pass [1] and it's been working really well for me. I have a dedicated PGP key that encrypts all my passwords, and they're stored on my own git server.

On Linux I use the pass command, on Windows I use QtPass [2], and on Android I use Password Store [3] and OpenKeychain [4] (for the PGP key).

My "master password" is the password for the PGP key, and I type it each time I want a password. Git keeps everything in sync. If one of my devices is compromised, you still need the password for the PGP key. If my git server is compromised, you'd need the PGP key (which isn't on the server).

[1]: https://www.passwordstore.org/

[2]: https://qtpass.org/

[3]: https://github.com/zeapo/Android-Password-Store

[4]: https://www.openkeychain.org/

[beojan]

Why use a PGP key instead of symmetric encryption (either with a random key encrypted with your master password, or a key derived from your master password)?

[Waterluvian]

I use an algorithm. In short:

1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to.

Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email.

It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution that is much better than using the same password for everything, but naturally is worse than using significantly different passwords.

I've used this for a few years to great success. The one issue I have is I sometimes have to try multiple times when one account is many types of services.

[rockostrich]

Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to and even realize that your password has some sort of generation algorithm, but it would be a bit more secure to hash that password in some way.

That's why I like using LessPass (even though people talk a bit of shit about it whenever it's mentioned on HackerNews). I have a single master password, the rest of my passwords aren't compromised if I accidentally expose one of them, and I can log in to any site from any device with a browser. Of course, use 2FA when you can, but it's nice to have a secure first layer of defense.

[saflkdeating]

I do basically the same thing, and have for years also. My only frustration with this is that with some sites, due to arcane password restrictions, the algorithm either isn't implementable, or is only implementable in such a way I won't remember. So 90% of the time the strategy works great, and in 10% of the time it fails due to idiosyncracies of the sites involved.

I hate the stupid restrictions sites place on passwords. There should be almost no restrictions.

[ProblemFactory]

The Algorithm is a great solution - breaking the pattern would require password leaks from 3-4 different sites, and a human to spend time puzzling over it. For automated bots the passwords look unique.

What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you are up to?

[ohthehugemanate]

What do you do for forced password change requirements?

Does your threat model include anything NOT bulk, ie where a human would see a password and guess the pattern?

Have you tried any of the password managers that have integrations, to automate password changes in case of failure?

Have you ever heard of the security concept of minimizing your attack surface?

[mattferderer]

I'm a fan of mixing this idea with something like 1Password. Obviously depending on the application, the security increases or decreases. My approach is to memorize multiple base passwords though & then mix it with some random gibberish. So I might write my password down like this:

KXl2h!H (H)

That would tell me that the password is KX12h! plus whatever the base password for H is. My hope is that unless someone was really targeting me, I would be skipped over as not worth the effort.

This way, even if someone broke into 1Password or one of my other password managers, they still wouldn't have the password.

The part I struggle with most, is how/where to store these & Authy/Google Authenticator tokens in a manner that they can be delivered to specific people in the case of my death without decreasing security.

[mud_dauber]

I use the same algorithm and am very happy with it.

[jimwalsh]

This is very very similar to what I do and it works out great!

[NoGravitas]

I'm a bit surprised at all of the people suggesting "remember one password, and mutate it with an algorithm based on the website name". That means that if you have to invalidate one password for any reason, you have to change all of them. On every service that you use. Do people really do this?

[jhasse]

Yes, I really do this. No one said that this method isn't without its disadvantages.

[chrisper]

Yes. There are some passwords that I have to remember since putting them into a password manager is not possible.

[QuadmasterXLII]

You most likely already have another single point of failure: the email account that you use for "forgot your password" resets. So, I make that the only point of failure by choosing long, secure passwords and not really trying to remember them, resetting the password every time I need to log in to a rarely used account

[tga]

* descriptive, long passphrases, that I usually have no trouble remembering. e.g. Facebook could be "I talk to my friends".

* salt to make stupid password rules happy and to make it somewhat safe to write down passwords. e.g. "mysecretsalt42$". This gets appended to all passwords and doesn't get written down anywhere.

* encrypted text file, used rarely when I forget a password. e.g. `vim -x socialmedia.txt`. I find this a bit better than Keepass or pass because it's not one obvious attack target (both the file and app).

* optionally, a paper backup

[kqr]

I might adopt this strategy. I really like most aspects of it.

[danicgross]

We really need passchange.js: an open source collection of headless JS scripts that can programmatically change your password on a given website. Then you would continuously rotate _all_ your managed passwords as well as your master.

Not a panacea, but significantly minimizes the length of a theoretical breach.

[aaraujo]

I used a small script to generate my passwords : I choose a simple password, I append the domain and I hash the string. I take the first 15 characters of the hash as a password. I find it quite convenient and easy to remember !

sha256("password"+domain)

[TheHCA]

This seems like one of the simpler solutions on here, what's your process of dealing with sites that require special characters etc?

[ecesena]

You may want to have a look at MemPa (also commented above) [1]. Please LMK what do you think, info in my profile.

[1] https://hackernoon.com/mempa-a-modern-deterministic-password...

[netsharc]

So... your passwords are 15 characters of the combination 0-9, a-f?

[smt88]

Use KeePass. It's FOSS, has a great extension for FF, and stores your passwords in a local, encrypted file. No cloud necessary.

[sciencerobot]

I use https://www.passwordstore.org/.

[slice-beans]

I also use pass and sync it with my android phone using OpenKeychain to manage GPG keys and PasswordStore as the actual password browser. Copy/pasting randomised passwords on both desktop and mobile is easy once these are set up.

[stevekemp]

I use the same, stored with git to allow me to share the "store" across a small number of hosts.

If you use git to store your passwords you can use that to see the age of entries neatly too:

https://blog.steve.fi/rotating_passwords.html

[bhhaskin]

I decided to try pass a few months back. Absolutely love it. It is so simple, and builds off existing & proven tech of gpg & git. Can't recommend enough!

[encima]

I use a simple 'cipher' that makes new passwords easy to remember and remains relatively secure without the need of a book/service.

I have a file of the first word that comes to mind for every letter in the alphabet. Then my password is created based on some features of the site.

I.e. eBay has 4 letters so I could choose: 'Elephant_4_Yankee'

The delimiter is up to you and you could just as easily choose every second letter or whatever.

Yes, it does mean my Netflix password is a bitch to put in but I know it off by heart.

[codeful]

Second this. Domain should generate chiper for a password. You get unique password for every website and you dont have to remember it

[ateesdalejr]

Only problem is this would allow some pretty simple dictionary attacks if you use the method described.

[zimbatm]

"Just use a password manager" is actually a simplification for doing proper threat modelling because most people don't bother thinking about it.

For each site you have to consider; what is the worst thing that could happen if somebody gain access to that account? Do you have a meaningful online presence on the website? Did you enter private information that you don't want to go out? Did you provide your credit card to the site? It would actually be useful if sites where classified by the type of information and access that they require.

Another short answer would be: memorize your computer, email and password-manager passwords. Use the password manager for day-to-day sites. Add a second factor for juicy targets like net banking. For all the other sites, generate a random string and throw it away. Use password reset the next time you want to log into it.

[BareNakedCoder]

I use https://securemypw.appspot.com (because I wrote it).

I need to remember just 1 good password (that I don't use anywhere else). I use it to encrpyt different passwords for different uses (gmail, banking, etc). I put the url with encrypted password in my bookmarks and a google doc (to share with my wife).

To hack me, the attacker would need get both the link (from my laptop's bookmarks) or from the google doc ... and then would need to guess the password to decrypt it.

[doltreey]

I know it doesn't answer the question, but it does hit at the heart of the issue. I use Enpass - the only password manager I could find that doesn't store your info for you--because I was also concerned about breakins and single points of failure. I am able to keep my entire password collection on my local hard drive and in whatever online storage tools I'm using currently (onedrive, google drive, etc). This seems to fit well while removing the issue with online password managers.

[wonder_er]

I'm surprised at how little advocacy there is for 1password.

Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm.

It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account.

If anything is truly important, it will have 2 factor authentication.

If someone has access to my unlocked physical machine and an unlocked 1password UI, I'm screwed. Additionally, they could use the wrench approach [0] to gain my credentials.

This is not a use-case I'm actively trying to prevent. Nor is protection against state-level actors targeting me in particular.

Further benefit of 1password: my wife and I both use certain shared logins to access things like credit card accounts.

Instead of me having to get her on board with my password book, or special algorithm, I can just move a login into our shared password vault.

I suspect most people reading this are in a similar boat - we're more than happy to pay a few dollars to hire millions of dollars of specialized security knowledge to outsource this problem for us.

This is just too mundane a solution for most people to comment on.

Long live 1Password!

[0] https://xkcd.com/538/

[SnowingXIV]

I switched to this after being a long time lastpass user, I'm regretting it. It's visually a lot better but it is terrible at generating passwords and saving them. On both windows and mac with chrome I click the 1pass icon and click generate (nothing happens). If something happens it shows up as a new entry if I go into the vault with no site or anything just a random string that I then maybe copy paste? (ugh). There also is nothing that pops up that lets me alter the specifications for the randomly generated password. Lastpass did an amazing job of this, 1password just seems broken all over the place.

When I did the export/import it ruined tons of passwords because if it had an ampersand symbol (&) it turned it into & resulting in me editing tons of passwords manually. It sucks at saving passwords too, lastpass just worked.

Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc. So, basically I went from free but kinda ugly to pretty but broken and more $. This has been the worst trade deal in the history of trade deals, maybe ever.

YMMV but I wish I didn't switch and to move back would be another annoyance that I might do if I didn't just pay for the year.

[exhilaration]

I've been happily using 1Password 4 for many years, my credentials are encrypted and synced via Dropbox. But I hear the latest versions require you to use their cloud service, the self-hosted version is no longer available. Is that true?

I use 1Password for not only credentials but as a document vault for everything from passports, birth certificates, anything else that falls under "needed after the house burns down". It's one of the most elegant pieces of software I've ever used.

[whalesalad]

My wife and I do the same which is hugely convenient. You can store more than website logins as well, such as credit card numbers, drivers license details or our passport information.

We do a lot of travel and financial witchcraft so having full access to each other’s into at the unlock of a thumbprint is extremely convenient.

We also have a team vault at FarmLogs which is hugely helpful for sharing access to singular accounts.

It’s such a valuable tool that I don’t even think about paying for it.

[cristoperb]

I've used supergenpass[1] with some success, but the fact that some websites have special requirements for passwords means that I still have to memorize more than one password.

1: https://chriszarate.github.io/supergenpass/

[peyloride]

The idea is awesome but i think it lacks usability on mobile.

[wakamoleguy]

If you're worried about storing your passwords somewhere where they could be compromised, one alternative is to simply not store them:

1. Generate a long random password.

2. Use that password once, but don't make any effort to store or remember it.

3. When you need access to the service, use the Forgot Password flow. Return to Step 1.

This is admittedly inconvenient, especially on mobile, and it won't work well if you routinely use devices that cannot access your email. But...it is an alternative approach that removes the need for a password manager.

In my personal experience, this approach has worked well for services I use rarely, especially those with good Forgot Password flows or long remember-me session times.

See also: Passwordless[0] is a Node library that discusses a similar approach to authentication from the service's perspective.

[0] https://passwordless.net

[reacweb]

I have a file on the local drive of my office computer and a sheet of paper near my home computer (used by me and my wife). When the sheet of paper is full of handwriting, I bring it to office to synchronize both list.. When my house has been robbed last year they have not found the sheet, but if they had, I could have changed all passwords very quickly. In case of fire, the backup is safe in a remote location. It is easy to carry, duplicate or destroy. The security at office is ensure by the IT service. This may be imperfect, but I think my list of password would not be the main target of an attack. At home, my wife is often present and would quickly notice if a burglar steal the list. When I go on holidays, I take the home list with me. I think it is quite successful.

[tomelders]

I use a formula that I can figure out in my head and I just remeber that. I don’t know any of my passwords, but I can figure out my password when I need it.

It has problems on sites that have shitty password rules. But for those sites, i just mash the keyboard then rely on the forgotten password link.

[paulmd]

If your PC is compromised it's pretty much game over, using a password manager does not really worsen the damage in that scenario At that level of compromise they can probably add a root cert, MITM your connections, and grab your passwords anyway.

If you're concerned, you could use separate files for different levels of security, which would give you the theoretical ability to compartmentalize the loss. But again, if you're compromised to that extent it's game over, there is nothing you can do that will allow you to operate securely on untrusted hardware/OS, you simply can't let that happen.

It's not like that's an unreasonable goal, the combination of Ublock Origin, Windows Defender, and common sense have kept my systems clean for 10 years now.