News for hackers. Stuff that matters.
Re:Two-factor paper passwords by atemerev on Tuesday May 03, 2016 @09:26AM (#11620386)
My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced.

But I have a good memory and I trust it much more than my ability to keep things organized and make routine backups. It's easy for me to generate more or less secure passwords that I can memorize, like:

shrebangodiKe24+ binarKedonado!3297 Miregofinar--0009

etc.

Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore.

Then, I'll be screwed.

Re:Two-factor paper passwords by chime on Tuesday May 03, 2016 @09:29AM (#11620414)
> My problem with password managers is that: a) I have more than one computer, b) I lose physical objects routinely, and my computers tend to break down and be replaced.

Dropbox with KeepPass on Windows / KeePassX on Mac / MiniKeepPass on iOS works beautifully for me.

Re:Two-factor paper passwords by distances on Tuesday May 03, 2016 @09:39AM (#11620491)
And KeePassX on Linux / KeePassDroid on Android. It's simple and works.

The biggest issue is that the passwords are usually copied via the clipboard, so any program accessing the clipboard could copy your passwords. It's of course up to your own assessment whether this is a problem worth consideration or not.

Re:Two-factor paper passwords by NoGravitas on Tuesday May 03, 2016 @10:11AM (#11620806)
Consider using Keepass2Android rather than KeePassDroid. Instead of using the clipboard to transfer passwords, it provides an input method (a soft keyboard) that will type your passwords to your applications.
Re:Two-factor paper passwords by distances on Tuesday May 03, 2016 @10:24AM (#11620958)
Thanks for the tip, I'll try it out!
Re:Two-factor paper passwords by avar on Tuesday May 03, 2016 @09:27AM (#11620399)
Any password manager worth considering these days can sync across multiple computers given your master password.
Re:Two-factor paper passwords by NoGravitas on Tuesday May 03, 2016 @10:13AM (#11620820)
Or you can just sync your encrypted password database over ownCloud or Syncthing, or whatever.
Re:Two-factor paper passwords by majewsky on Tuesday May 03, 2016 @09:32AM (#11620435)
I've started to use a stateless password management scheme for that purpose: https://github.com/majewsky/pwget
Re:Two-factor paper passwords by czechdeveloper on Tuesday May 03, 2016 @10:03AM (#11620733)
I've tried this (or similar, own implementation), but got stock on weird requirements that some services imposed. In about 50% of cases, I had to modify generated password anyway (usually make it shorter). So instead of remembering password, I had to remember what restriction which service had.
Re:Two-factor paper passwords by danielweber on Tuesday May 03, 2016 @11:41AM (#11621599)
Services should publish, in a computer-readable format, what the password requirements are.

Unfortunately many places consider this information sensitive and protect it fiercely.

Re:Two-factor paper passwords by gist on Tuesday May 03, 2016 @12:17PM (#11621967)
> But I have a good memory and I trust it much more

Note that "a good memory" doesn't "scale" or remain constant over time. Plus more importantly you are assuming that something minor or major won't happen to you where for some reason you aren't able to remember things very clearly like you thought you would be able to.

Re:Two-factor paper passwords by cpach on Tuesday May 03, 2016 @09:32AM (#11620442)
”Those will last for a few more years, until password crackers will become so fast that it will be impossible to remember any kind of secure password anymore.”

I don’t think you need to worry about that. See https://news.ycombinator.com/item?id=3140898

Re:Two-factor paper passwords by sigio on Tuesday May 03, 2016 @09:37AM (#11620477)
I use passwordstore.org's pass... which just syncs all the passwords via git (and they are encrypted with gpg). So I have redundancy/backup/versioning and the rest is just seperate (gpg'd) textfiles.
Re:Two-factor paper passwords by tajen on Tuesday May 03, 2016 @10:30AM (#11620993)
Have we proven that password managers are safe? It's worth for black hats to spend as much money to break a password manager as the most expensive secret stored in it. If most of the secrets of the world are stored in there, ...
Re:Two-factor paper passwords by jwl on Tuesday May 03, 2016 @10:11AM (#11620809)
I would recommend something like https://getvau.lt

Generate your passwords with a simple algorithm with a servicename and a keyphrase. Works really well.

Re:Two-factor paper passwords by fredley on Tuesday May 03, 2016 @09:58AM (#11620669)
I think this approach is better for your mom than for your average developer. I use LastPass and it continues to be difficult even for me to use, less savvy people wouldn't have a hope.
Re:Two-factor paper passwords by r3bl on Tuesday May 03, 2016 @10:13AM (#11620830)
How is it difficult? I trust the security settings on my laptop, so I'm always logged in on my main browser. The process is as simple as entering the website and clicking on log in. When I register to something new, I just click on "save password". I generate passwords using Alt+G.

Comparing this to not using password managers, (in my opinion) I would say that LastPass is both easier and safer alternative than not using one.

Re:Two-factor paper passwords by fbnlsr on Tuesday May 03, 2016 @10:12AM (#11620816)
I'm also a Lastpass user, and while the service is near to flawless, I keep thinking that the UI is really bad. I wish they could work on that.
Re:Two-factor paper passwords by fredley on Tuesday May 03, 2016 @10:23AM (#11620932)
Yeah. It's slow, and just plain badly designed in places - crucial interactions hidden behind icon-only menus etc. I really hope they sort it out one day.