Hacker News Reader

Comment by joe_the_user | Hacker News Reader

You know,

I just had a thought. What I would like is password protected, "password notepad". When activated, it remembers the text of passwords, shows it to you in text when you go to a website and then you type it into the site. (people looking over your shoulder is a way overestimated danger, the password-hiding thing dates to shared terminals).

The thing I hate about password managers is I am afraid I would stop knowing my passwords. This would allow me to remember my passwords since I would type them each time.

I've only seen Firefox and Chrome's built-in password managers so maybe this exists already. But it seems a decent way to do it.

View on HN

> The thing I hate about password managers is I am afraid I would stop knowing my passwords.

That is a feature. The handful of passwords I know are mostly long passphrases. The rest are long random strings, generally up in the 30-something character range.

In fact, I don't even know some of my logins anymore: I will use or at least append random characters to most accounts that don't have any 'social' functions (that I care about). I also use a unique email per site.

If an account is compromised, it's got a very low chance it'll even connect to another account I own (at least not without human interpretation), and zero chance of helping with cracking any of my other passwords (other than hinting you can skip guessing anything <30 characters).

I have backups of my password file, I have email recovery (to a domain I own) - knowing individual accounts is just unnecessary.

How do you have unique emails per site?

I use a catch-all subdomain (like *@something.mydomain.com) that simply forwards to my main account. I then sign up on sites using something like news.ycombinator.com@something.mydomain.com or hackernews@something.mydomain.com.

I've been doing it since ~2001. The only downside is long e-mail addresses, but my password manager deals with that for the most part.

Subdomain is important, otherwise you get dictionary-style spam email attacks (as well as everything coming to whoever owned the domain before you, if anyone). I've never noticed that style of attack to the sub-domain.

I've also got very little actual spam to this. A handful of e-mail addresses were obviously leaked/sold but by far the bulk of the spam I get comes to my primary e-mail address which I never use to sign up for anything.

I've been doing that for over a decade. It's great. If I get a phishing email about my iCloud account, but it's sent to my yahoo@mydomain.com then it's obviously a phishing attempt, not need to check for other markers. You can also see who has sold/leaked your email address for marketing purposes.

Not OP, but just a guess: you can use tags in your email (add `normal-email+tag-here@domain.org`) and it should go to the same location. If you host your own mail or have your own domain with an… M record? I don’t know—then you can easily create as many emails as you want and forward them to other accounts.

Some overly strict checks on some websites don't allow tags, but if you host yourself there's also the possibility to use `normal-email@whatever.domain.org`. Pretty convenient for filtering.

I have a domain just for emails, so any mail sent to the domain goes to me, so I can just sign up for a site as hackernews@mydomain.tld or whatever system i want for naming stuff. I still get every mail to the same mailbox, but if I start getting spam, I know which site sold my email, or got hacked.

Your proposal:

* Encourages bad (easy to type, and potentially memorable) passwords and password reuse (probably the single best way to get compromised). (I have several hundreds of unique passwords.)

* Makes phishing easier. (People are bad at consistently checking the URL bar correctly char for char and every time.)

* Is inconvenient.

* Can be done with any existing password manager.

* About shoulder looking... I don't know about you, but I frequently need my passwords at work when colleagues are watching, or when I'm sharing my screen in a (often recorded) conference call.

"Encourages bad passwords" - It seems pretty implausible a sequence of word-number-word-number is going to be inherently that weak.

"Makes phishing easy" - The manager would be checking the URL bar in the same fashion as a regular password manager.

"Is inconvenient" - Is not terribly inconvenient

"Can be done with any existing password manager" - Great, I suppose I should just get started using them then.

If you can remember your passwords, they're likely not great passwords to begin with. I've got hundreds of logins and remember only 2 - the password manager one and gmail which a lot of important things hang off of.

The big issue these days is users sharing a password between sites, so having them unique/random is the game.

So it seems like the plan is to just move from the single password to the password manager as the single point of failure.

It’s an interesting tradeoff. In the one hand you have a single, low entropy, shared secret you give out to any stranger offering you an account. On the other hand you have only a single stranger to trust who can keep track of unique high entropy secrets for all those other strangers. But it’s a very well known entity that many malicious actors are circling attempting to find a weakness, and it’s not only keeping your shared secret(s) it’s also keeping a record of every service you have an account with.

You don't realize how often in public places there are cameras recording you. Whether it's the password they see in the clear on your screen or you physically typing, it's a risk that you don't have when you use a copy/paste password manager.

The point of the password manager is that you don't remember your passwords.

> people looking over your shoulder is a way overestimated danger

Depends on your environment. I personally have learnt at least two people's email passwords just from watching them type (not to use, just to see how easy it was), and I've seen an instance of a Windows Domain admin password being shoulder-surfed. Making it easier seems questionable.

Reply on news.ycombinator.com