3 ms·
I tried to do something like this but ran into two problems: 1. it's not always clear what the domain is. Sometimes a company has more than one portal to enter
by savanaly 10y ago
I tried to do something like this but ran into two problems:
1. it's not always clear what the domain is. Sometimes a company has more than one portal to enter a login. Now I have to remember which one I was using when I created the account. I can try to use the company name but that's ambiguous as well because sometimes the portal's or product's name is different from the company's name and now I have to remember what the "domain" is.
2. Different services have mutually contradictory requirements for passwords. You mentioned you add '$1Aa' to appease some websites, but I have encountered ones that have a no symbols rule, or some that have minimum length 12 while others that have maximum length 10.
I believe the most reasonable solution is to use a password manager.
- dheera 10y agoOne option would be to host a public text file (on Github, even) that describes various services, their password requirements, domain aliases, and have the script tack on the approriate strings based on the public text file. Others could even use the same script and submit pull requests describing new services they encounter. My main objective is to eliminate personal databases.
- Kliment 10y agoOkay, so say I submit a pull request for a phishing domain pretending to be an alias of something, and months/years later trick you into visiting it. Seems risky to me.
- dheera 10y agoThis would only be risky if I got phished into visiting your phishy domain AND was stupid enough to consciously want to enter a password into it, in which case the risks are the same as if I used a human-memorized password. My password "manager" doesn't automatically fill in passwords until I consciously ask it to. But some amount of human oversight over those pull requests would be in order.