Hacker News Reader

Comment by caio1982 | Hacker News Reader

caio1982

Honest question: despite work-related stuff (like, for a sysadmin or whatever), in a personal scenario how many passwords do you guys have to manage so it's worth using an app for that? I only have 5 active (and other 2 old) entirely different passwords for types of usage and each have between 13-18 chars with capitals, numbers and all the shit. I just store them in my mind. What's the real/basic use case for passwords managers?

View on HN

It's recommended that you have a different password for every site, not just for every type of site. If, for example, someone discovered your forum password, under your system attackers could take over all of your forum accounts.

Lots of us sign up for lots of sites to try out things, engage in one-off discussions, etc, so it's pretty necessary to have a password manager.

I'll point out that if you creates those passwords yourself, rather than using an entirely random generator, they likely have less entropy than you think, and so are more crackable. A password manager helps with that.

> I'll point out that if you creates those passwords yourself, rather than using an entirely random generator, they likely have less entropy than you think, and so are more crackable.

So true. I generate my passwords separately, for the simple reason that I haven't yet found a pssword manager that would fit me perfectly. Pass is getting relatively close.

In the meanwhile, I keep my passwords either on [LUKS] encrypted partition or a GPG protected file. I can even disclose the exact method I use for generating these passwords:

  head -c 9 /dev/urandom | base64 -

For high-value targets or if I'm feeling a bit more paranoid than usual, I go for 12 octects instead.

You could get higher entropy with

apg -a1 -n1 -m9 -x9

since it will have a greater alphabet

Entropy in bostik's example is controlled by the -c parameter to head, not by the size of the destination alphabet. If you increase the number of bytes read you'll see the length of the resultant string start to grow accordingly.

I use a different 32 chars alphanumeric password for every site I'm registered at (http://a.pomf.se/zpubyy.png), so it's easy to have 20+ passwords to remember (I have ~35 in my keepass database), which is a bit hard to do without a password manager.

I guess the use case is if you're a bit paranoid and want to use a strong/different password for everything.

Password reuse is really bad for security. And without password reuse it is easy to see how the number of passwords explode even in moderate use.

I use different randomly generated passwords and randomly generated answers to those stupid security questions for every identity I have, which is a lot. I was willing to trade money and time to use a third party tool to manage these, because I can't remember an arbitrary number of arbitrarily long strings of nonsense.

Apparently, i have 887 entries in the osx keychain. Mind you, some sites show up multiple times.

I try to use a different password for each new account. Since the password manager handles the credentials for me it's not much more effort than reusing the same login/password everywhere.

I have 25 passwords managed by pass, all personal and not work related.

Reply on news.ycombinator.com