Hacker News Reader

Once you have a counter, you have state, and you might as well just use a password manager.

It may be you're working in the one environment where the master password + derived password scheme + counter scheme would be an improvement, but the above objection is why it doesn't work well for most users.

> We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would only require you to pick and remember a strong master password.

This has been tried. While it initially sounds appealing, it is a monumentally terrible idea.

* You need software to implement the scheme.

* Rotation is a problem, you need a counter for state

* Different services have widely different password rules which are additional state

* If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked

* People choose passphrases just as badly as they choose passwords

Just write your passwords down. Maybe leave a few characters off or don't label them.

> * If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked.

It all comes down to the threat model you are defending against. The threat model I'm defending against is automated attempts to catch me reusing the same password with different accounts.

Even if you were defending against a motivated actor putting human eyes on your passwords, something like`XXXXXXsXXXXXXsssXX` where the X are reused across sites and the s is a derived, site-specific chunk is a) as good as completely random until your adversary is manually correlating multiple leaked passwords for you and b) not trivially obvious to derive once they are correlating multiple leaked passwords.

> until your adversary is manually correlating multiple leaked passwords for you

This is a thing that is done, and even automated. If you have a couple password dumps, checking levenshtein distance between them is not hard.

I know that environment well, you pretty much have to come up with a hash function you can do in your head. Is it secure? Maybe you can pull it off. I think most people can't, and that's what leads to people writing down passwords.

Writing down passwords is usually less bad than password reuse and use of weak passwords.

Depending on the physical security posture of the location where the passwords are stored, that can be a correct statement. I wouldn't argue "usually" simply because most people aren't smart about where they're stored.

It depends on the threat vector, though. Printing out my passwords in 72-pt font and taping them to the wall is obviously insecure if I leave them up for the house cleaner to see, but there's zero risk that a remote attacker will see them (barring them taking over the webcam or something, but at that point they probably have root access anyway).

Or paying your housecleaner to take a picture and email it to them...

Its the same concept of the majority of offline password managers. You are hiding all of your amazing 32 character randomly generated unique passwords behind a single memorable password.

BUT its safe, because unless YOU are the target of the attack, the contents of your random slip of paper on your desk, or the password protected one note file on your dropbox, or the encrypted pwsafe3 file on your usb stick are outside of the reach of some bad actor trying to get ALL of the passwords, not just YOUR password.

Did you reply to the wrong comment?

Normally, to attack a password manager, you must have a copy of its database. With a deterministic password scheme, this is not required. This proves to be disastrous in practice for cryptocurrencies.

No, I'm saying writing your password down in a notebook on your desk in your locked office is nearly as safe as any offline password manager.

If you aren't the one under attack, and you still create different passwords for each service, the method of offline password storage (be it a spread sheet, a password manager, or a sticky note) are all similarly-ish safe.

The key is to come up with a repeatable pattern that defeats whatever repeatable pattern detection that is in place and just apply it. You don't write down the password, you write down parts of the pattern.

Is it secure? No. But if you work at a place where SSO isn't a thing in 2018, it's not secure anyway.

This. I had a keyboard pattern I used in a similar environment. Just shift a row over every month. I couldn't ever tell you what the password was from memory, but could type it in no problem.

This is bad security advice. Don't this if at all possible.

> I currently work in an environment where I don't have access to a password manager

How is that reasonable? If you make a case that restricting password managers lowers security, could you possibly change it?

Password card.