https://pocketmod.com/ has this exact password system. It's under "Misc/Passwords" and shows a grid of random characters you can seed.
Write your passwords down (2010)
191–196 of 196 posts
Re: Write your passwords down (2010)
#192[deleted]
Re: Write your passwords down (2010)
#193Earlier quoted context omitted.
Then for such sites you add the date, maybe in the form of [year][password][courter]. Probably modified somewhat so it isn't obvious what is is.
A number of sites don't allow you to reuse iterations of old passwords (not sure exactly, but perhaps can't have more then 4 repeating chars). So you can't simply append, you have to change the actual password a considerable amount. Had a few websites like that, they were the bane of my existence until I got a password manager.
That's a serious security risk if a website knows your older password and you're newer password is just one character different than the older one.
old: year-password-counter (23supassword1) new: year-password-counter++ (23supassword2)
If website tells you that you cannot use your new password, then it screams that they're somewhat storing/accessing the old password. If they're storing just the hash, there's NO way it could have been detected. (Unless they take your new password and then check from a-z0-9 last characters, convert to its hash and then compare with old password hash) but in my entire IT Security career, I have never seen it doing anywhere.
Re: Write your passwords down (2010)
#194Earlier quoted context omitted.
Times in the last 40 years that... My wallet has been stolen: 0 My house has burned down: 0 LastPass has been breached: 2+ LastPass' browser extension has caused me headaches: 9000+
This is like posting to HN that GoDaddy screwed you. It's nothing but a self tattle anymore. The number of times gpg has failed to decrypt one of my "pass" entries: 0.
Yeah, I'm such a loser, right?
I didn't choose to use LastPass. It was foisted on me by my employer.
Re: Write your passwords down (2010)
#195Earlier quoted context omitted.
It’s not my preferred method because I want 2FA to save me if my device is compromised, but it does still add protection against traditional password attacks, credential stuffing, etc. It even adds a layer of phishing resistance, as long as the user doesn’t blindly jump to copy/paste when autofill fails.
What is the phishing resistance it adds? Bitwarden auto copies TOTP to the clipboard.
Depends on the password manager. 1Password will not autofill if the domain doesn’t match. It’s up to the user at that point to check the url before copy/pasting the code. My guess is that the average user would do that by reflex without a second thought.
Re: Write your passwords down (2010)
#196Earlier quoted context omitted.
A number of sites don't allow you to reuse iterations of old passwords (not sure exactly, but perhaps can't have more then 4 repeating chars). So you can't simply append, you have to change the actual password a considerable amount. Had a few websites like that, they were the bane of my existence until I got a password manager.
That's a serious security risk if a website knows your older password and you're newer password is just one character different than the older one. old: year-password-counter (23supassword1) new: year-password-counter++ (23supassword2) If website tells you that you cannot use your new password, then it screams that they're somewhat storing/accessing the old password. If they're storing just the hash, there's NO way i…
It absolutely is. It was my university website so couldn't avoid it either.