News for hackers. Stuff that matters.
Re:Ask HN: What is your password management solution? by weinzierl on Saturday July 15, 2017 @11:43AM (#14777203)
I don't question your memory, that is not my point. How long do you think it takes to crack a password that consists of digits of Pi or anything derived from it? And it's not about Pi either, it's just that you can't beat a computer in that regard.

For me, playing around with hashcat, was an eye opening experience and I truly believe in the Schneier quote from above.

Re:Ask HN: What is your password management solution? by SAI_Peregrinus on Saturday July 15, 2017 @05:26PM (#14779049)
Create a 10 word diceware passphrase, using the EFF's list. Try to memorize it, it shouldn't take long. Hash it with whatever hash you like. Even MD5. Try to crack it with Haschat. Spend as much time and/or money as you like on the project. It's got over 128 bits of entropy, you won't succeed before the Sun becomes a red giant and incinerates the Earth.
Re:Ask HN: What is your password management solution? by tuxxy on Saturday July 15, 2017 @12:00PM (#14777310)
I agree with Schneier's quote, but you're also forgetting about password hashing. If it takes 10 seconds to derive the key (assuming the use of a strong hash function), anything with a good enough amount of entropy (60-90 bits) should be fine.

When an attacker acquires a leaked database, they're not cracking high entropic passwords.

Re:Ask HN: What is your password management solution? by weinzierl on Saturday July 15, 2017 @12:05PM (#14777345)
Yes, what speaks for dheera's method is the use of a strong KDF and especially (a point that I missed initially) that they use a truly random master password.