New answers tagged password-management
0
You can use urandom in combination with tr and head to generate random passwords. With a a few small tweaks, you can adjust the length of the generated password and include/exclude specific types of characters to satisfy just about any site's requirements.
For example, to create a password 16 characters long containing just uppercase and lowercase letters:
...
1
The best known strategy for generating a password is to generate it randomly. The goal is for it to be as unique as possible, so that it's unlikely to be found in a password dictionary, which is often populated with passwords from previous breaches.
This doesn't change when the site has poor password requirements.
Many password managers will let you ...
14
If you have no master password set, then the login passwords are always available. If you do have a master password set, then opening the Saved Logins dialog will prompt you for the master password. Without the correct master password, the list of logins will be empty and thus there is no password to copy.
The bug only occurs in this specific condition:
A ...
1
KDBX4 can now use Argon2 which is the state-of-the-art in password derivation.
The difficulty to guess the password of a KDBX4 database depends on:
The chosen Argon2 parameters, which are poorly advised by Keepass, but still better than the previous AES-KDF. The parameters you describe are very poorly chosen, they will not strengthen by much the ...
4
I assume you are asking if you (the user NH) should trust a browser's built-in password manager, or if you should install a third party plugin; and not whether or not Mozilla should develop another password manager.
Before I get started, keep in mind that security isn't just about vulnerabilities or architecture or protocols or passwords; it's an overall ...
1
Like many of the above I also recommend the use of stories and fear!
In particular you need to explain WHY its so bad to have the same password across different websites, as perhaps she doesn't understand the problem with this. I find this is often the case with those outside of the IT industry. They see it as just a best practice suggestion and maybe even ...
-2
Great question/topic, and if the definition of password "management" here also includes "password generation" I would provide a Python program or similar that generates cryptographically-secure passwords of various lengths with just a few lines of code, and show the child how to easily run the program anytime they need a strong password. (as this would be a ...
29
Memorising a really strong master password is probably a bit much to ask
I disagree! I have a daughter who, at around 7, was able to quickly memorize a very strong password using the Diceware method for use in a password manager. This method picks several random words from a dictionary (typically) composed of 7,776 words. A mere 9 words is log2(77769) ≈ 116 ...
0
Now I am not sure if I am right but I think teaching basic mnemonic techniques to kids seems like a wonderful idea to me. It's a skill that will help her lifelong and will also aid in avoiding writing down any passwords and low entropy password. Consider a 10 digit gibberish password such as 1kej@!lej2. This could be easily remembered if you just made up a ...
15
"Logging in from multiple devices" if you do not own them, is one habit that would need to be stopped for general security.
Once you own all the devices in the scenario, one method that I saw for young people that was useful is to avoid dealing with passwords altogether: use the "forgot password" process.
If the device is owned and access to email is on ...
95
Maybe the lesson for children should be less about how to use tools to manage a password, and more about understanding why managing passwords is important?
Let them write their passwords in a notebook. Have fun with devising a method for obfuscation in case the notebook is lost. Teach them about backups- keeping a copy someplace safe. In my experience, kids ...
0
I will provide you with an example and hopefully this gives you some ideas on how to implement this.
For the bank I am using, we don't even have passwords, but we have the following security mechanism:
Components:
- Bank application
- Smart ID application
- 4-digit PIN code known only by the user
When I am opening the bank app, I receive a request from ...
1
You could ask for details about the actions the user has performed in your app.
Example: Show users a list of 3 popular merchants in the region out of which only one is used regularly by the user. Ask the user to select the merchant he has regularly paid using your app.
Options for trusted contacts like Facebook. The user can assign trusted friends or ...
7
One more I haven't seen mentioned explicitly (as of writing all existing answers also make good points):
If an attacker gets hold of one of your generated passwords, now they are able to try cracking your master password from it, gaining access to all your accounts.
It's relatively easy to get one low-value password, whether through phishing, plaintext ...
14
Besides those already mentioned, one more problem is that you cannot change your master password. Switching to a new master password would require changing your password on all the web sites where you've used the generator.
42
Here are two less often mentioned problems.
Determining the website is hard. You want to use a different password for a.github.io and b.github.io, but you want the same password for microsoft.com and live.com, or wikipedia.org and wikimedia.org.
Changing anything breaks passwords. Once you've released your password manager and people start using it, you can'...
18
1. Password managers provide additional options
A key difference between using a stateless password manager and a password manager is that password managers can store additional data such as
Security Questions
Credit/Debit card numbers
Id card numbers
Cryptographic keys
WiFi passwords
API keys, etc...
2. Existing passwords cannot be accommodated
Password ...
8
The problem is that it doesn't add that much meaningful security.
Instead of using your password directly, you use a publicly available function instead of your password. Let's use the example on their website for a demonstration:
Login: andromeda
Website: milkyway.com
Secret Keyword: 2,52m light years away
Produces password: 3q_q(MFWaMGeao+[CX
...
76
I have used a stateless password generator for years, and I think there are a lot of drawbacks:
If your master password is compromised, all of your passwords are. In comparison, standard password managers requires that the attacker both compromise the master key and gain access to the password store.
If a website has a password policy, you might not be able ...
2
What you are looking for is called a Key Check Value (KCV).
You create a KCV by encrypting a block of zero bytes in ECB mode (the same number of null bytes as your cipher’s block size), then saving the first three bytes of output as a six character hexadecimal string, such as A1B2C3.
In the future you can test a key by executing the same KCV algorithm; ...
Top 50 recent answers are included
