News for hackers. Stuff that matters.
Re:‘DiceKeys’ creates a master password for life with one roll by ocdtrekkie on Friday August 21, 2020 @01:46PM (#24237165)
> It’s like writing your master password on a sticky note and putting it in a drawer.

People should do this, and people should stop telling other people it's bad security to do this. And then people should stop using password managers.

The idea that the sticky note is bad is hilariously old school, and the result has been everyone putting their passwords in cloud-stored apps instead, which is 10,000% worse than a sticky note.

Remember: If it's on the Internet, your potential attacker is "every human on earth". If it's on a sticky note, your potential attacker is "everyone who can get access to the physical place you keep it". The former will always be an increasing number of billions of Internet users. The latter can be reduced to one or two if you store your sticky note somewhere very secure, like a safe or security deposit box.

Also, for added security... just lie on your sticky note. It doesn't have to be a high entropy lie to befuddle people.

Re:‘DiceKeys’ creates a master password for life with one roll by ViViDboarder on Friday August 21, 2020 @07:26PM (#24239967)
Encryption is a thing. If we can’t trust encrypted data then security the password is worthless anyway as everything is owned.

This is why password managers are generally considered secure. They store only client side encrypted blobs and do not store or know your master password.

Like you, I have no concerns with storing your master password on paper in a locked drawer or something, but it’s unrealistic to securely store post its for every password you need as well as have them readily accessible.

Re:‘DiceKeys’ creates a master password for life with one roll by ocdtrekkie on Friday August 21, 2020 @07:28PM (#24239982)
Readily accessible to you is readily accessible to hackers. People should re-evaluate how many things they must have access to everywhere they go.

For example, my 2FA tokens are backed up in physical storage. This means if I'm traveling and I lose my phone, I don't have access to them until I get back. But that's a lot safer than leaving them somewhere others can access them too.

Re:‘DiceKeys’ creates a master password for life with one roll by ViViDboarder on Sunday August 23, 2020 @11:40AM (#24252640)
Hackers don’t have quantum computers to crack my password vault.
Re:‘DiceKeys’ creates a master password for life with one roll by doctoboggan on Friday August 21, 2020 @02:12PM (#24237391)
But you have to agree that memorizing your password is more secure than writing it down.
Re:‘DiceKeys’ creates a master password for life with one roll by ocdtrekkie on Friday August 21, 2020 @04:51PM (#24238760)
Of course. But not everyone is good at that.
Re:‘DiceKeys’ creates a master password for life with one roll by codetrotter on Friday August 21, 2020 @05:45PM (#24239198)
correct battery horse staple, but longer and sensible but still unique, and optionally without space.

Make up a sentence that makes sense to you, and remove all the spaces, use all lowercase and no special characters.

Forgettable: 5uP3r53kr17P455w00r[)!!11One

Memorable: ilikestartrekandhamandbeans

I used to have full-disk encryption on one of my machines using a password of the forgettable kind. But then the machine had an uptime of months until a power outage, and I realized that while I was fairly sure of the sentence I had no possibility of remembering all of the uppercase and lowercase and symbol and number substitutions. I lost quite a bit of data that day.

After that I began using a sentence that makes sense to me but which is not from a book or anything like that for the FDE on my desktop and external hard drives, and I use the pass phrase frequently. Simplicity and repetition is the key to remember your master password.

As for websites I use a password manager, and I sometimes generate passwords with my own diceware software https://github.com/ctsrc/Pgen but most often I am on my phone or on my laptop and then I use the password generator of the password manager that comes with those Apple devices.

I haven’t lost any more data since switching to managing my data encryption and my passwords this way.

Re:‘DiceKeys’ creates a master password for life with one roll by moltar on Friday August 21, 2020 @08:16PM (#24240349)
I’m using 1Password and it encrypts the payloads before they are shipped to the cloud. How does that compromise my passwords?
Re:‘DiceKeys’ creates a master password for life with one roll by kentbrew on Saturday August 22, 2020 @09:45PM (#24248870)
This, of course, is the correct answer.