151–160 of 250 posts
My alternative is believing that not all websites you log into pose the same risk to you and accepting some risk. This means I divide websites that require login into two categories: 1. I don't care if somebody gains access to my account 2. I do care if somebody gains access to my account I use the same password for all the websites on the first category. It should be at least 8 characters long, consists of a made up…
Each account an attacker can gain control of, is more information they can glean and potential leverage points to gaining access to the accounts you do care about.
Earlier quoted context omitted.
I add a special character at the end when it's needed
This works, but doesn't scale. The problem is, the login form doesn't remind that a) a special character was required and b) what characters that particular site thinks are "special".
I use https://bixense.com/pwcalculator/ (GUI for hashing alias + site) and dedicated passwords for services I need to access more often.
I looked at the algorithm this thing uses - it's just base64(sha1([master password][alias])) with some data munging to deal with endian issues. Would be trivial to do GPU accelerated cracking.
Hopefully sites use their own salted, better hash algorithms anyway.
I use https://bixense.com/pwcalculator/ (GUI for hashing alias + site) and dedicated passwords for services I need to access more often.
Still has the issue of a password manager. Compromise the machine, record the "secret".
I've used supergenpass[1] with some success, but the fact that some websites have special requirements for passwords means that I still have to memorize more than one password. 1: https://chriszarate.github.io/supergenpass/
The idea is awesome but i think it lacks usability on mobile.
https://play.google.com/store/apps/details?id=info.staticfre...
I use SGP for the bulk of my throwaway accounts.
For me, https://www.passwordstore.org/ and a Yubikey is the best setup I've tried. It's quite a lot of work to set it up though.
Earlier quoted context omitted.
Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to and even realize that your password has some sort of generation algorithm, but it would be a bit more secure to hash that password in some way. That's why I like using LessPass (even though people talk a bit of shit about it whenever it's mentioned on HackerNe…
> Doesn't this compromise all of your passwords if one of your passwords is discovered? I've been trying to understand password managers for a while. My workplace forces us to use one. But what you've said doesn't make sense. If your "master password" used in the password manager is discovered, then all your passwords are compromised. If my laptop or phone gets stolen and someone knows the password from my password m…
Earlier quoted context omitted.
I do basically the same thing, and have for years also. My only frustration with this is that with some sites, due to arcane password restrictions, the algorithm either isn't implementable, or is only implementable in such a way I won't remember. So 90% of the time the strategy works great, and in 10% of the time it fails due to idiosyncracies of the sites involved. I hate the stupid restrictions sites place on passw…
I have the same issue. My full password is over 20 characters, but some websites restrict to less than that or don't accept the special character that I use.
Earlier quoted context omitted.
Why would anyone suspect that? You're talking about what 1 in several million users? All you have to be is above the threshold of "easy to hack". I'd like to be referred to such a thing if there is one already.
The specific tool mentioned uses a trivial scheme. If I were trying to crack a large breach, I'd probably try running a few billion master passwords with that algorithm.