11–20 of 64 posts
I keep 2 files actually. Day to day stuff and critical services.
So I only open up and therefore expose my master password infrequently for the critical services. (i.e. banking etc.)
I've enabled 2FA on everything I can.
So I think I'm safer than this deterministic solution as if my master password gets out, you still have to get past 2FA.
Is it just me, or would the suggested C++ usage leak the all the credentials to the history buffer?
https://addons.mozilla.org/pl/firefox/addon/password-hasher/
Despite the inflammatory title, these kinds of password "managers" that are stateless and rely instead on a hash system come up quite frequently but they never have an answer for some basic problems that plague real-life accounts and passwords. * Requirements of character sets used on different services. One upper case, two special characters, and 18 octothorps required. * Differing rotation schedules. ___ Bank force…
Despite the inflammatory title, these kinds of password "managers" that are stateless and rely instead on a hash system come up quite frequently but they never have an answer for some basic problems that plague real-life accounts and passwords. * Requirements of character sets used on different services. One upper case, two special characters, and 18 octothorps required. * Differing rotation schedules. ___ Bank force…
My tool uses a revocation list for scheduled password changes. Normally, the password is generated as
i = 0
return kdf(masterpassword, sitename, 0)
The revocation list technically makes the password manager not-stateless, but I don't care. If I ever lose it, I can just generate passwords for each site and revoke them until I find the one that works.
For all the other concerns that you list, I have a textfile listing all my accounts, and the weird derivation rules that are required for some of them (e.g. "take first 19 chars, then append capital A"). That text file is in a private Git repo. Now you could hack my notebook to get at that repo, but if you do, all is lost anyway, so as far as my threat model goes, it's not a problem to have this text file.
Despite the inflammatory title, these kinds of password "managers" that are stateless and rely instead on a hash system come up quite frequently but they never have an answer for some basic problems that plague real-life accounts and passwords. * Requirements of character sets used on different services. One upper case, two special characters, and 18 octothorps required. * Differing rotation schedules. ___ Bank force…
I use a system that I wrote https://github.com/kybernetikos/sinkless (incidentally it uses a similar system to this article - PBKDF with SHA512 - in browser plugins) that supports many of these situations. * The character sets can be entered manually. They form public information and are stored locally, can easily be exported as csv. * Each password has a 'version' which you can increment. The version is considered p…
Despite the inflammatory title, these kinds of password "managers" that are stateless and rely instead on a hash system come up quite frequently but they never have an answer for some basic problems that plague real-life accounts and passwords. * Requirements of character sets used on different services. One upper case, two special characters, and 18 octothorps required. * Differing rotation schedules. ___ Bank force…
Forgot what the hash sign was otherwise known as: https://en.wiktionary.org/wiki/octothorps