3 ms·
Before switching to a standard password manager I used to use the algorithmic equivalent of this: I used supergenpass which took the domain name and a master pa
by chillacy 11y ago
Before switching to a standard password manager I used to use the algorithmic equivalent of this: I used supergenpass which took the domain name and a master password and hashed them (probably HMAC'd) so that I could have the password be strong but not stored.
Ultimately though what got in the way were obscure password requirements of some websites (especially banks). Some banks required a "special character" that wasn't in the hash's output, other sites thought 16 characters was too long for a password, other sites didn't like some of the non alphanumeric characters (no joke).
As the exceptions started piling up I started having to do lots of password resets on these usual suspects before giving up this scheme and moving to a traditional password manager (1password).
Just thought I'd share my experience with this sort of thing.
- timwinfree 11y agoGreat thoughts. You've highlighted some of our hurdles. I helped develop the app with Robert. There does seem to be a trend to make passwords less restrictive (or at least longer). For example, Schwab just removed their ridiculous 8-character restriction this summer. Hopefully that continues. In the meantime, we address that issue a few ways: 1) we have a report card that you can check while writing a recipe that guides you toward producing more universally accepted passwords 2) if you find a password still doesn't work for a particular site, you can affix a "note" to that recipe so you can record the adaptation (e.g. "change $ to &") I use Password Chef for everything, and have a surprisingly few amount of notes. So few, in fact, that I have memorized the adaptation I need to make for most of them. Thanks so much for the comment!
- chillacy 11y agoAh good that you've thought of this too. Seems like you guys already have some good workarounds