Hacker News Reader

Comment by bikamonki | Hacker News Reader

I believe so far my brain is still the best, if not only, secure password storage. To add a layer of security while reducing password complexity, I coded a small hasher so my brain remembers easy phrases and passwords come out of this tool über strong. I suppose I am still vulnerable to social engineering hacks or the attacker getting a hold of my hasher, but for such cases the only layer left is whatever vendors implement to defend its users, like SSL, 2FA or external devices.

View on HN

I like this idea. It allows you do something as simple as:

"[password phrase] + facebook"

"[password phrase] + bank"

etc for all of your passwords, and as long as the hasher works well, you have strong, random passwords for everything.

Still, that's just one password. Do you use this one password for all your accounts, or as input to a password manager?

Or are you just manually copying and pasting this one super good hash into all your accounts? :/

Different phrases->hashes for each vendor. The brain can easily remember what short phrase corresponds to what vendor.

Up until one of the vendor's databases leaks on the internet and we find out their passwords were stored in cleartext.

I assume you have hundreds of accounts like I and most people I know have. If you can recall hundreds of passphrases, including passphrases for accounts that you don't access for several years, and you can continue recalling these hundreds of passphrases even while changing them regularly, how else are you making use of your exceptional memory? Just curious.

I wish I had an exceptional memory ;)

Only 4-5 accounts require a strong password. The rest I don't care, I use the same password or request a reset every time I go back.

I do the same. However, sometimes that requires a phone call with a wait time of 30 minutes + identity verification =( This is the case with Blizzard.

I make a record of them shrouded in a mnemonic that I can figure out but that would be useless to a stranger.

I do manually copy/paste.

What do you do on pages that require / forbid special characters and require / forbid length >8 characters?

Thats an easy tweak (global replace the forbidden characters after hash) on the hash generator and for the max length I normally just copy paste the required length.

But how do you know which transformation to apply when you log in? Unless you store the rules for each site somewhere, but then it's not really portable system.

Like I said before: rules are stored in my brain. So far reliable and portable :)

have been tinkering with this idea also something like

   *echo -n 'my unique passphrase' |sha512sum*

only issue is this shows up in your memory and on disk (e.g. .bash_history)

Prefix the command with a space and bash won't save it in its history.

This doesn't seem to be true in 4.3.42, at least not by default. " echo test" shows up in both the output of the 'history' builtin and in ~/.bash_history.

Is it an option that needs to be set?

Yes, you need to have HISTCONTROL=ignorespace option in your .bashrc

great thanks didn't know this one. Just checked and there is also

# don't put duplicate lines or lines starting with space in the history.

# See bash(1) for more options

HISTCONTROL=ignoreboth

sounds like one shall pass: https://oneshallpass.com/

Very much the same (I was too lazy to use anything else than JS!) but my code has some built in tricks ;) What if an attacker constructs a very long list of phrases/term permutations based on one's social engineered data? Then run a loop (with zero restrictions) on 1SP code to get n possible hashes/pwds. That list could have the password! My code has one more layer of security: discover my tricks :)

I like that 1SP is open source. One could download it and add complexity to it! But to use the 'standard' version is a risk.

Reply on news.ycombinator.com