TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: How'd you manage the password managers' master password?

17 点作者 imcotton超过 1 年前
In general, I like to be helped by password managers to do the heavy lifting, but how to make out the best of the master password?<p>xkcd&#x2F;936 is OK-ish for educated geeks, but in practice for a large amount of no-tech users, they only have a few candidates of fruits, sports, animals, or city names to pick from, let alone not to mass it up in memory at some point.<p>For now, the best option seems to store a complex master password in your phone&#x27;s keychain and protect it with biometric authentication, but it&#x27;s important to keep your phone safe. If someone steals your iPhone and the passcode, they could wipe out your iCloud account within just a few clicks.<p>Now shameless plug, I&#x27;ve just posted &quot;accdoo cipher&quot; on Show HN two days ago [1], and if you have one second to spare, here is my pa33w0rd for demonstration [2].<p>Any other ideas?<p>btw: I feel relieved that password managers (Bitwarden and 1Password for example) only require a minimum length for your master password. There are no complicated rules to follow, which is great. I hope other companies follow their approach.<p>[1]: https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=39115559<p>[2]: https:&#x2F;&#x2F;accdoo.app&#x2F;#0118-999-881-999-119-7253#256

18 条评论

kutenai超过 1 年前
I just memorize it. Write it on a small sticky and hid it somewhere for a period of time until the master is memorized.. then destroy it.<p>you could write it on that flame paper they use in spy novels.. now that would be cool also. Does Amazon carry that?
评论 #39154168 未加载
评论 #39147338 未加载
roland35超过 1 年前
I have a circle of password managers all storing each other&#x27;s master password
评论 #39146566 未加载
mortallywounded超过 1 年前
I&#x27;m not really sure what it&#x27;s called, but mine is based on a sentence I have memorized combined with some fixed symbols. I basically take the first letter of each word and keep capitalization and symbols.<p>For example, if the sentence I memorized is, &quot;I dreamt I was a butterfly! What a wonderful sight it was.&quot; my password would be: IdIwab!Wawsiw.
acheong08超过 1 年前
I’ll be changing my password after this comment but here’s how I did mine:<p>&lt;nickname unused since 12 years ago&gt;&lt;phone number that no longer exists&gt;&lt;another phone number but with shift keys&gt;&lt;random http status code&gt;
vipa123超过 1 年前
For some password hardening I take a short random password I already have memorized like abc1oktt and then use my own phonetic change... For example, That one becomes ehbesee1ohcayteaTea... For my master password I take three different of these and just concatenate them together to make a nice long passphrase... Not for everyone, I&#x27;m sure. But for me it essentially reinforces and reuses passwords I&#x27;ve known for 25 years... I also convert numbers like SSN or phone with a similar poor cipher... Nein,Ate,Sefen etc..
Zetobal超过 1 年前
My favorite band has really long song titles so it&#x27;s rotating between song names with some added numbers.<p>My last one was &quot;The One Armed Boxer vs. the Flying Guillotine.1234&quot;. Numbers changed ofc ;)
评论 #39143220 未加载
zwayhowder超过 1 年前
I use Diceware. 6 random words with alphanumeric padding. So basically the XKCD, but something like:<p>correct_2_horse_2_battery_2_staple. In my experience it doesn&#x27;t take long to memorise the words.<p>I have two passwords I know off by heart, my password manager and my gmail (just in case). I also capitalise a certain letter in each word, but that pattern is in my head only.<p>I am of course lazy, so I use biometrics on my phone&#x2F;tablet&#x2F;laptop to minimise the need for entering my password. But I wouldn&#x27;t if I still worked in a high risk industry.
评论 #39142650 未加载
评论 #39141967 未加载
wruza超过 1 年前
There&#x27;s an ancient trick to memorize your complex password: enter it twice a day for a week or so.
account-5超过 1 年前
I don&#x27;t know the master password for my password manager. I remember the way I type it on the keyboard. Disadvantage being I really need to be in front of a standard keyboard to open the vault.<p>I also use a keyfile too for added security.
ssss11超过 1 年前
Multiple words strung together that are important to you…
Erratic6576超过 1 年前
Song verses are easy to memorise and quite long to type
blinded超过 1 年前
I just memorize the 20 char random strings.
patatino超过 1 年前
Printed emergency kit from 1Password in a bank safe so my wife can access everything if I die.
embeng4096超过 1 年前
It usually shows up as stars so I don&#x27;t need to worry about other people seeing it, see: hunter2<p>Jokes aside, I memorize my password manager&#x27;s master password, and have it written down in a notebook but in a different glyph set (Idk the scientific name). It&#x27;s not ciphered or anything so can be decoded, but the chances of somebody recognizing Elian script are fairly low, I think, and recognizing something like Royal House of Riftgard script even lower. And if you use something like Elian script it can be obfuscated further by stylistic alterations. That, combined with a rotating cipher, even something like rot13, is probably enough to defeat all but the most determined attackers, in which case I&#x27;ll have bigger things to worry about, like the XKCD wrench (<a href="https:&#x2F;&#x2F;xkcd.com&#x2F;538&#x2F;" rel="nofollow">https:&#x2F;&#x2F;xkcd.com&#x2F;538&#x2F;</a>)
millzlane超过 1 年前
supersecure password X 2<p>s0 S2oMeThIng Tha! uses words with r@ndom CaPs spaces 123456789s and Spec!@l ch@racters=-!s0 S2oMeThIng Tha! uses words with r@ndom CaPs spaces 123456789s and Spec!@l ch@racters=-!
ElevenLathe超过 1 年前
Keep it on a piece of paper somewhere safe.
yoyopa超过 1 年前
Passw0rd!@#$!@#$!@#$!@#$
LabMechanic超过 1 年前
I have three options for you, along with my two cents on each:<p>1) *Bitwarden:*<p>I am no longer using Bitwarden since they can delete your account at any time for any reason[5].<p>2) *KeePassXC:*<p>For KeePassXC, you need to store your &quot;Passwords.kdbx&quot; (~16 kB) database file somewhere and remember a master password.<p>3) *Spectre (<a href="https:&#x2F;&#x2F;spectre.app&#x2F;)\\\" rel="nofollow">https:&#x2F;&#x2F;spectre.app&#x2F;)\\\</a>*<p>I haven&#x27;t tried it yet; however, Spectre calculates your password each time you need it. All you need is a name (e.g., your full name), your master password (see Diceware[1]), and the site name, from which Spectre algorithmically calculates your password. If you need to change a site&#x27;s password, iterate the counter and calculate a new password.<p>It works offline and is open source. Here&#x27;s a web app version that runs locally:<p>[Spectre Web App](<a href="https:&#x2F;&#x2F;spectre.pw&#x2F;" rel="nofollow">https:&#x2F;&#x2F;spectre.pw&#x2F;</a>)<p>*Bonus: One-Time Pad + (Layman-ish) Physics:*<p>There are plenty of reasons to be paranoid[2]:<p><pre><code> - Firmware-wise (e.g., Intel Management Engine, Coreboot, Libreboot, system on a chip) - Hardware-wise (i.e., Von Neumann architecture - Code + Data) - Operating System-wise (e.g., 0-click exploits, remote code execution to manipulate the CPU&#x27;s instruction pointer, stack overflow, Pegasus) - Facility-wise (e.g., electromagnetic waves, cell towers, Faraday cloth) - You (making mistakes) </code></pre> Given the above, I would first base everything on &quot;true&quot;[A] randomness (see random.org or roll casino-grade dice). &quot;True&quot; randomness is essentially: &quot;every outcome has the same probability.&quot; As long as backward time traveling remains impossible, I would abstain from computers and simply follow the One-Time Pad protocol with a pen and paper, among other things.<p><pre><code> Message: Hello -&gt; ASCII -&gt; Binary Key: 5EYES (keep this private, must be random) Cipher: &lt;Message in binary format&gt; XOR &lt;Key in binary format&gt; -&gt; convert back to ASCII </code></pre> The above is just one (i.e., XOR) out of many ways to follow the one-time pad protocol. For 128 characters, you need a random number from 0 to 127. However, you need to ensure that each number has the same probability to show up. Perhaps there is a way to encode or &quot;rename&quot; the numbers from 0 to 127 with a string of digits 1, 2, 3, 4, 5, 6 so that you can roll a die multiple times in a row to randomly get a number between 0 to 127 (see Diceware[1]). One-time pad might be good to encrypt your master password.<p>*References:*<p><pre><code> 1. Diceware, [Wikipedia](https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Diceware) 2. CS155 - Computer and Network Security, [Stanford](https:&#x2F;&#x2F;crypto.stanford.edu&#x2F;cs155old&#x2F;cs155-spring18&#x2F;syllabus.html) 3. [One-time pad - Wikipedia](https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;One-time_pad) 4. Animated Explanation of the one-time pad, https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=QVV_bUxxiZ8 5. https:&#x2F;&#x2F;tosdr.org&#x2F;en&#x2F;service&#x2F;1348 </code></pre> *Notes:*<p><pre><code> A) If you assume determinism (because our current &quot;collective bias&quot; leads us that way), then the quote marks are okay; if not, then not. Personally, everything seems to be based on assumptions or beliefs anyway (your existence, math, ...), so I go by &quot;ignorance is bliss.&quot;</code></pre>
评论 #39153864 未加载