Groups > linux.debian.user > #194332

Re: Password Manager opinions and recommendations

From	"der.hans" <deb-user@LuftHans.com>
Newsgroups	linux.debian.user
Subject	Re: Password Manager opinions and recommendations
Date	2018-03-30 21:00 +0200
Message-ID	<vz7pL-2ir-3@gated-at.bofh.it> (permalink)
References	<vxgdP-5Um-11@gated-at.bofh.it> <vxol3-3lp-1@gated-at.bofh.it> <vyXTr-4AI-3@gated-at.bofh.it> <vz26J-7oc-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Am 30. Mar, 2018 schwätzte rhkramer@gmail.com so:

moin moin,

> As I sometimes (often?) do, just commenting on a few points:
>
> On Friday, March 30, 2018 04:39:05 AM der.hans wrote:
>> Am 26. Mar, 2018 schwätzte Richard Hector so:
>>> On 26/03/18 04:52, rhkramer@gmail.com wrote:
>
>> We can add character set requirements and most sites now allow 30+
>> characters, so they at least look random.
>
> Good point, I hadn't really thought that one through--I thought maybe I'd
> generate an intentionally longer password and then just delete unallowable
> characters.  (Or maybe the "right size" password and then substitute (random)
> allowable characters for the unallowable characters.
>
> I'm not sure what that would do to the cryptographic security if the
> passwords.

They should still be fine provided they're long. I sometimes change out
characters.

When I run into password limitations on a site I add notes to the KeePassX
entry, e.g. "max pw length=15" or "doesn't allow % and &". For the latter,
I would change % and & in the randomly generated passwords to some other
non-alnum. That's one of the few occasions that I see passwords for
anything other than system logins.

Also, KeePassX can generate random word groups, ala correct horse battery
staple.

https://xkcd.com/936/

The following article has more info about password generation with
KeePassXC.

https://www.darkreading.com/endpoint/heartbleed-a-password-manager-reality-check/d/d-id/1204549?

>>>>    * a means to automatically update passwords on the target websites
>>>>    (to
>>>>
>>>> facilitate regular / frequent password changes)--this is probably a
>>>> stretch--I mean something that would work its way through the various
>>>> screens and prompts to change a password with a minimum of manual
>>>> intervention by me
>>>
>>> Difficult. That would have to be scripted for each website etc, wouldn't
>>> it?
>>
>> Many of the KeePass* tools support auto-type which will send a sequence to
>> the browser. The sequence can use the default pattern or be customized.
>>
>> I believe one of the commercial, proprietary tools offers to change all
>> your passwords for you and uses a JavaScript client to do so, so perhaps
>> there's already a model to replicate.
>
> Hmm, if anybody can shed more light on that, I'd be interested--not sure I
> could make use of it in any quick fashion, but, if it exists, I'd like to
> learn more about it.

Lastpass has some auto-change functionality. Turns out it's only for
specific sites. I recall claims during the Heartbleed reaction that they
could change all the passwords. Probably me mis-remembering, but they make
other bogus claims ( securely sharing passwords where the recipient can't
see that password ), so I might be remembering correctly.

Lastpass did add a feature to automagically check a site for Heartbleed before
authenticating. That was awesome.

https://helpdesk.lastpass.com/generating-a-password/#h2

Still, we could build templates for different sites with URL and auto-type
script for password changes.

Captcha is still annoying and needs an "I am a cyborg" option.

ciao,

der.hans

>> I don't use auto-type, so haven't investigated beyond seeing that it's
>> there. I have had multiple people report that it works well for them.

-- 
#  https://www.LuftHans.com   https://www.PhxLinux.org
# "I came to open source for the tech, but I stay for the people."
# -- Richard Gaskin, 2016Jan25

Thread

Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-25 18:00 +0200
  Re: Password Manager opinions and recommendations likcoras <likcoras@riseup.net> - 2018-03-25 18:40 +0200
    Re: Password Manager opinions and recommendations Ben Finney <bignose@debian.org> - 2018-03-26 00:10 +0200
  Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-25 19:50 +0200
    Re: Password Manager opinions and recommendations Roberto C. Sánchez <roberto@debian.org> - 2018-03-25 20:10 +0200
      Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-25 20:50 +0200
        Re: Password Manager opinions and recommendations Ángel <debian-user@debian.16bits.net> - 2018-03-25 23:20 +0200
          Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-26 21:40 +0200
            Re: Password Manager opinions and recommendations Mark Fletcher <mark27q1@gmail.com> - 2018-03-27 04:50 +0200
  Re: Password Manager opinions and recommendations Richard Hector <richard@walnut.gen.nz> - 2018-03-26 02:40 +0200
    Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-26 04:00 +0200
      Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-26 22:00 +0200
        Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-26 23:40 +0200
          Re: Password Manager opinions and recommendations Joe <joe@jretrading.com> - 2018-03-27 10:10 +0200
            Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 14:50 +0200
              Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 15:00 +0200
        Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 03:10 +0200
          Re: Update: Re: Password Manager opinions and recommendations Abdullah Ramazanoglu <ar018@yahoo.com> - 2018-03-27 03:40 +0200
          Re: Update: Re: Password Manager opinions and recommendations Kushal Kumaran <kushal@locationd.net> - 2018-03-27 07:00 +0200
            Re: Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 14:40 +0200
          Re: Update: Re: Password Manager opinions and recommendations Joe <joe@jretrading.com> - 2018-03-27 10:00 +0200
            Re: Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 14:50 +0200
          Re: Update: Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-27 13:20 +0200
            Re: Update: Re: Password Manager opinions and recommendations Richard Hector <richard@walnut.gen.nz> - 2018-03-28 04:30 +0200
              Re: Update: Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-28 12:40 +0200
          Re: Update: Re: Password Manager opinions and recommendations Tomaž Šolc <tomaz.solc@tablix.org> - 2018-03-30 14:00 +0200
            Re: Update: Re: Password Manager opinions and recommendations Curt <curty@free.fr> - 2018-03-30 14:50 +0200
              Re: Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-30 16:10 +0200
                Re: Update: Re: Password Manager opinions and recommendations Cindy-Sue Causey <butterflybytes@gmail.com> - 2018-03-31 01:00 +0200
            Storing "real" user data: was: Re: Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-30 16:00 +0200
              Re: Storing "real" user data: was: Re: Update: Re: Password Manager  opinions and recommendations Greg Wooledge <wooledg@eeg.ccf.org> - 2018-03-30 16:20 +0200
              Re: Storing "real" user data: was: Re: Update: Re: Password Manager  opinions and recommendations "der.hans" <deb-user@LuftHans.com> - 2018-03-30 20:20 +0200
    Re: Password Manager opinions and recommendations "der.hans" <deb-user@LuftHans.com> - 2018-03-30 10:50 +0200
      Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-30 15:20 +0200
        Re: Password Manager opinions and recommendations "der.hans" <deb-user@LuftHans.com> - 2018-03-30 21:00 +0200
          Re: Password Manager opinions and recommendations Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-03-31 03:50 +0200
            Chaniging focus: security ouitside a password manager (was: Re: Password Manager opinions and recommendations) rhkramer@gmail.com - 2018-04-02 15:10 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) <tomas@tuxteam.de> - 2018-04-02 15:20 +0200
                Re: Chaniging focus: security ouitside a password manager (was: Re: Password Manager opinions and recommendations) rhkramer@gmail.com - 2018-04-02 20:30 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) Roberto C. Sánchez <roberto@debian.org> - 2018-04-02 15:30 +0200
              Re: Chaniging focus: security ouitside a password manager likcoras <likcoras@riseup.net> - 2018-04-02 16:00 +0200
              Re: Chaniging focus: security ouitside a password manager Ben Finney <bignose@debian.org> - 2018-04-03 01:30 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) "der.hans" <deb-user@LuftHans.com> - 2018-04-03 02:10 +0200
              Re: Chaniging focus: security ouitside a password manager Richard Hector <richard@walnut.gen.nz> - 2018-04-03 08:00 +0200
                Re: Chaniging focus: security ouitside a password manager rhkramer@gmail.com - 2018-04-03 13:50 +0200
                Re: Chaniging focus: security ouitside a password manager Cindy-Sue Causey <butterflybytes@gmail.com> - 2018-04-03 18:30 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) Brian <ad44@cityscape.co.uk> - 2018-04-03 11:40 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) Brian <ad44@cityscape.co.uk> - 2018-04-03 21:10 +0200
  Re: Password Manager opinions and recommendations Abdullah Ramazanoglu <ar018@yahoo.com> - 2018-03-26 03:40 +0200
    Re: Password Manager opinions and recommendations Abdullah Ramazanoglu <ar018@yahoo.com> - 2018-03-26 04:20 +0200
      Re: Password Manager opinions and recommendations Ben Caradoc-Davies <ben@transient.nz> - 2018-03-26 05:10 +0200
  Re: Password Manager opinions and recommendations Ben Caradoc-Davies <ben@transient.nz> - 2018-03-26 04:00 +0200

csiph-web