31–40 of 96 posts
I've often wondered why login systems don't simply rely on the same system they use for password recovery. Instead of logging in with a username and password, why not request a login token that is emailed to me. I then use that link to access the site and never really have to think about passwords.
Something I have always pondered,...would it be more secure to request a password after the user has been identified by the system? For example,... 1. User clicks login 2. Webcam uses facial recognition to identify the user. 3. The identified user is requested to enter their password. In this case, I think, it is harder to impersonate the real user. I am no expert but would interested to know if anyone can see any ob…
A face is a username, not a password. I can take a picture of you and hold it up in front of the webcam. And my picture will work every time unless you decide to get surgery.
Earlier quoted context omitted.
You could always just pick a number that you want to use and repeat/trim the name? So if you picked 9 you'd use AMAZONAMA as the base for amazon, but HACKERNEW for hacker news?
Hmm, did I use "hacker news" or did I use "ycombinator" or did I use "news.ycombinator" or....? You have to be specific when you pick the algorithm if it's to work the way the author suggests, and preferably something that is not easily shifted, such as the domain name and not the site's title.
1Password It replaced all my alternatives and I don't have to think anymore about passwords. It saved me a lot overseas and doing a new fresh install in my computers is not painful anymore.
I try to ignore articles like this and I'm surprised that this was written in 2015. As @jeremysmyth noted this method is flawed. There's no solution for passwords today, better than the password manager. People reading this article, should not consider Manuel Blum's idea as use-worthy.
Password managers have a central point of failure, either it's breached or its password/data is lost I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'
Why not use a base64 encoded sha1 hash of your password salted with the web address like this: #!/bin/sh #usage: webpass.sh website=$1 stty -echo read -p "Password: " password echo stty echo echo -n "$website" | openssl sha1 -hmac "$password" | cut -d" " -f2 | xxd -r -p | base64 | tr -d -c "[:alnum:]" echo At least this is somewhat cryptographically secure.
1Password It replaced all my alternatives and I don't have to think anymore about passwords. It saved me a lot overseas and doing a new fresh install in my computers is not painful anymore.
I like it as well, the only problem is when I'm using someone else's computer, e.g. to check my emails.
This method fails as soon as you have to change a password: - One of the sites is compromised - One of your devices is stolen/lost and you have to change some passwords - One of the sites has a password expiration policy Pretty soon you end up with multiple password schemes and you're in precisely the same situation as before, wondering which password goes with which site, only this time you have to perform algorithm…
• Passwords that prevent double characters within the password: not ideal when using a scheme.
• Passwords with a minimum/maximum length: I've seen sites with a minimum of six characters and other sites with a maximum of eight characters. That means, to cover them all, you really have to choose a password of exactly six, seven or eight characters and even then it's no guarantee.
• Sites that prevent certain punctuation and other sites that require punctuation. That means you have to remember which sites require which.
• Likewise, sites that require/prohibit capital letters or require a mix of case.
It's a nightmare doing anything other than recording them somewhere. And recording them somewhere is not great either as you always have to carry that thing with you and, if it's electronic, remember to charge it.
I try to ignore articles like this and I'm surprised that this was written in 2015. As @jeremysmyth noted this method is flawed. There's no solution for passwords today, better than the password manager. People reading this article, should not consider Manuel Blum's idea as use-worthy.
Password managers have a central point of failure, either it's breached or its password/data is lost I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'
Write your password on a piece of paper and store it safely (what constitutes 'safely' may vary. For most people, an envelope in the bottom of a drawer is plenty safe.). Put the actual password database on Dropbox and make sure it's replicated in a couple of locations.
> they're not the 'ultimate solution'
Nobody said that, so your quote-marks are out of place. The GP said that there is no better solution today.