4 ms·
It's more about password hygiene. Do you have any advice how to prevent disclosing not making UX harder? I would happily implement it.
by homakov 9y ago
It's more about password hygiene. Do you have any advice how to prevent disclosing not making UX harder? I would happily implement it.
- zwily 9y agoAgreed on the hygiene... However, we're humans, and even the best of us will make a mistake at some point. The impact of that mistake in that scheme seems potentially catastrophic in a way that's different from traditional password managers. I don't see an easy way to fix it given your design goals (which I really like!)
- homakov 9y agoI never really tried to type my password and hit Send, so I never worried about this case. Hygiene has to be reshaped to understand how important master pw is compared to all pw we used to type, like 123456.
- zwily 9y agoThe times I've seen people type passwords into Slack has usually been because they had the wrong field focused, and autopilot typed the password and hit Enter. (To be clear, this complaint applies to all schemes that rely on passwords derived from a master password.)
- GordonS 9y agoI've done it once before, with Keepass and Lync. I was working on several tasks at once, area bit of a frenzied pace. I had a few Lync chat Windows open. I copied my password from Keepass, alt-tabbed to what I thought was the browser, pasted and hit enter. Oops, wrong window... I've had people paste their passwords to me a couple of times over the years too.
- inimino 9y agoOne clever UI way around this would be to not use Enter in the master password field. Instead use something on the homerow like "jkl" to end every password. Then the input field just accepts whenever /.*jkl/ matches. This mostly solves the "wrong focus" problem because hitting Enter is no longer part of the muscle memory. Of course you could still enter it into a shared Google doc or something else that discloses without Enter, so it's only a partial solution.
- zwily 9y agoIn the case where a master password does get disclosed (for whatever reason), how does a user change their password everywhere? I don't see anything about that in the README.
- homakov 9y agohttps://news.ycombinator.com/item?id=14482166 https://news.ycombinator.com/item?id=14482166
- reitanqild 9y agoSlightly harder but may generate some good ideas/discussion: A two-part password (no, not two factor) where part 1 is stored by the browser and recommended to be written down or otherwise recoverable part 2 is remembered by the user from day to day. Now if the user types the password into the wrong field or the keyboard is bugged they should still be fairly safe as long as part 1 is a good password on its own.
- smarx007 9y agoHow do we scale it to multiple mobile devices?
- reitanqild 9y agoDon't think I understand your question. Or maybe I didn't understand the original idea.
- homakov 9y agoHe means how does your 2 part scheme scale (it is hard). With 1 password you simply enter it again on another device.
- reitanqild 9y agoOk, the point was that part one was easily recoverable by the user. So they could sign up another device by just opening a safe and finding it or sit down with book x and reconstruct it. So slightly harder but still very much doable.