Ask HN: Password best practices?

1. https://lastpass.com/ 2. https://agilebits.com/onepassword 3. http://keepass.info/

Each password for a service is then randomly generated and stored in the archive; you don't need to remember them, you just need to access the archive.

For default, I have chosen 60-character password length, upper-lower-numbers-spaces-special characters mix (as a rule of thumb, a longer password is preferable to a more complex password).

For whatever reasons, some services refuse this combination - and that's a huge red flag: if the service at least hashes the password, it should get a uniform, eminently storable string out. If they care what characters go in ... well I ain't saying they're storing the plaintext, but it's close enough to arouse suspicion. One of the worst offenders seems to be Skype, with its "maximum password length: 20 characters, no weird characters allowed." If that happens, well, you can override the default and generate a weaker password for that one service, or vote with your feet and not provide your account details to such a suspicious contraption.

Use a encrypted storage for your password, protected by a master password. This can be as simple as text files on encrypted volume, or a more complicate password manager.

When you can avoid using passwords, do so. For example, key based SSH auth prevents you from having to re-enter passwords all the time, and is generally more secure.

When given the option of 2-factor authentication, take it. 2FA + a weak password is usually better for security than a strong password without 2FA.

Password to lastpass is long and completely unique - not used anywhere else.

lastpass generates and maintains passwords for all sites - they are all 16 characters long (long passwords are key for preventing bruteforce typically), unique, and they all contain numbers, upper and lower case characters, and symbols.

The thought process is - if one of the passwords is compromised (hacked site, brute force, etc.), the same password will not be usable on other sites. I had this happen in my WoW days.

Edit: I have the lastpass app trusted on my phone so I have access on the go.

I don't use any american solutions due to Snowden's revelations. I don't want NSA on my passwords. Prefer an open source program.

If you want a cloud system, with keepass on your smartphone automatically updated, I think you should create your owncloud server.

And for the rest of the bunch, I switched to 1Password. It doesn't support Linux, but that's okay for me. I do most of my browsing on iPad and MacBook.

Specifically, if someone gains access to your physical computer and they figure out your LastPass password, what happens next?

If you choose to use LastPass, make sure you do it with a fantastically long, entirely random password.

Example: "3BA^h<VQgj+nL%KP$ (this was completely randomly generated at http://passwordsgenerator.net/)

For a little reasoning, look into how passwords are generally hacked. Usually, hackable passwords consist of words or l33t words (l!k3 th!5) that are somewhat related to the person. A massive number of people use the same words or patterns for these things, so a brute force attack informed by a l33t-smart dictionary (minus the definitions) often is the cause for a hack like this. Furthermore, in different languages, there are more frequently used letters and spelling conventions, which can inform the dictionary's ordering or choice of words. (Think: colour vs color)

However, if the person does indeed use a random sequence of characters, the average person doesn't usually go outside the alphanumeric range. If the password is only lowercase, that's 32 characters. If it contains uppercase, that's 62 characters.

So then, we can take that information and use it to understand the complexity of a brute force algorithm based on possible permutations and other info.

Take a look at this: http://www.passwordmeter.com/

(Disclaimer: I do not hold any type of CS degree or formal training in cryptography. I've listened to a few classes online though.)

An example of an algorithm could be the first two letters, the last two letters and place those around the name of the person who created the service. This is a poor and somewhat weak algorithm, but the main idea is given the service's name you are not only able to derive the password, but each service has a unique one.

I recently went looking for a passphrase generator that supports the http://xkcd.com/936/ scheme, and failed to find one I thought I could trust. So I created [1], which is about as simple as it can get, is loaded (from my own server) over SSL and doesn't rely on anything server-side or use any frameworks, so you can easily verify it by hand. It does rely on Firefox at the moment as Chrome doesn't have the crypto functions it needs yet. I intend to clean it up and publish it properly, but I'm all out of tuits, let alone round ones.

[1]: http://ares.aylett.co.uk/pw/

I tried using tools keepass and dashlane. They are good, and work most of the time, but irritant with few sites, enough for me to not use them.

[0]: http://www.zx2c4.com/projects/password-store/

[1]: http://git.zx2c4.com/password-store/about/

I'm currently storing everything in a separate OSX keychain with a strong 20+ character password but there seems to be very little out there describing how OSX encrypts the notes. I can only find articles from a few years ago staging it's 3DES but I would like to think its been upgraded since then.

You could use a password card[1]. Just print an keept it on a safe place (your wallet :-D).

or

Get a long and complex Password you can remember (there are lots of techniques to create and remember a passwort). After that add a site-specific phrase to your password. For example: [YourLongAndComplexPasswort]H4ck3rn3w$ As you can see, H4ck3rn3w$ is the site-specific phrase for the hacknews-website.

[1] http://www.passwordcard.org

* Use a passphrase of at least five random words.[1]

* Keep that passphrases secret.[2]

* Use a password manager like 1Password or Keepass to generate and manage all other passwords.[3]

[1]: Good passwords have high entropy and are easy to remember. For that reason, passphrases are preferred to passwords.

[2]: It's ok to write down your passphrase, but keep it somewhere safe -- like your wallet.

[3]: Password managers prevent password reuse and make life easier. Sync passwords across devices.

for more: http://bdd.io/security , with linked justifications.

For instance...

"Cause I know that time has numbered my days And I'll go along with everything you say"

Becomes...

ciktthnmdaigaweys

Becomes...

c1k77hnmd41g4w3y5

I use this system for all of my passwords. I try to use a different password as often as possible and never have to write them down. Frequently used passwords have gotten to the point where inputing them is an exercise in muscle memory.

What do you do when you need to connect in a PC that is now yours? This happens to be very often in parties when people want me to use my spotify.

Also do you keep your rsa passphrase in the archive?

As for what I do now: I integrate the service name in my password in different ways depending on the name. The combination is long enough and has enough entropy that I feel comfortable against bruteforce attacks, but is quite a mind juggle to find my password sometimes.

Consider which are most important accounts (email would be prime candidate) and have the login details for them written up on a physical paper stored in a secure place. This is to prevent catastrophic data loss in the situation where your primary way of managing passwords fails for one reason or the another.