4 ms·

KeePass should let users configure a pattern for passwords, like "8-25 letters or numbers or these symbols, must have 1 uppercase letter", and just replicate th

KeePass should let users configure a pattern for passwords, like "8-25 letters or numbers or these symbols, must have 1 uppercase letter", and just replicate that socially (the pair of web site and pattern) across all KeePass users.

scrapcode 10y ago
Sounds like a good idea at first, but could also be a huge attack point.
- Bartweiss 10y ago
  The "replicate" bit sounds deeply alarming - a password manager using social or learned rules just screams vulnerability. If you made me guess an attack, I'd picture someone paying for a server cluster or botnet to repeatedly assert super-restrictive rules, and then use their knowledge of those rules to guess the generated passwords. Allowing some basic rule-setting, though, sounds quite nice. Arbitrary restrictions will probably leave people setting bad passwords, but there are some very common flags like "must have a special character" or "can't have a special character" that it'd be convenient to access for these sites.
tacostakohashi 10y ago
Sure, but there are other password managers with this same problem. I'm suggesting something more like the tz database - a common, authoritative source of truth for any password generator / database app to use. Just like the tz database, it would require some maintenance, but I think it would be worthwhile (yes, I would volunteer to maintain it, if others were to volunteer to add support for same in the various keepass implementations I use).
Bartweiss 10y ago
Even without the social aspect, it would be nice to just have some common flags you can set like "uppercase required, special characters banned" when generating for a specific site.
WorldMaker 10y ago
It does let you configure a pattern and even save the pattern for reuse. It's the replicate socially that's not implemented. Might be a fun idea for a KeePass plugin.

scrapcode 10y ago

Sounds like a good idea at first, but could also be a huge attack point.

Bartweiss 10y ago
The "replicate" bit sounds deeply alarming - a password manager using social or learned rules just screams vulnerability. If you made me guess an attack, I'd picture someone paying for a server cluster or botnet to repeatedly assert super-restrictive rules, and then use their knowledge of those rules to guess the generated passwords. Allowing some basic rule-setting, though, sounds quite nice. Arbitrary restrictions will probably leave people setting bad passwords, but there are some very common flags like "must have a special character" or "can't have a special character" that it'd be convenient to access for these sites.

tacostakohashi 10y ago

Sure, but there are other password managers with this same problem. I'm suggesting something more like the tz database - a common, authoritative source of truth for any password generator / database app to use. Just like the tz database, it would require some maintenance, but I think it would be worthwhile (yes, I would volunteer to maintain it, if others were to volunteer to add support for same in the various keepass implementations I use).

Bartweiss 10y ago

Even without the social aspect, it would be nice to just have some common flags you can set like "uppercase required, special characters banned" when generating for a specific site.

WorldMaker 10y ago

It does let you configure a pattern and even save the pattern for reuse. It's the replicate socially that's not implemented. Might be a fun idea for a KeePass plugin.