5 ms·

Your suggestion is bad for a ton of reasons. For example, how do you change your password for a specific site after it had been compromised or due to normal pas

Your suggestion is bad for a ton of reasons. For example, how do you change your password for a specific site after it had been compromised or due to normal password rotation? Another downside is that changing master password means you need to change passwords for all sites or have multiple master passwords. Another is that an attacker can use the knowledge of your password on site A to bruteforce your master password offline. And so on...

l0b0 9y ago
Why on earth is this being downvoted? If you've used a hashing generator for any length of time you'll know how multiple master passwords inevitably creep in. Also, when your generator no longer works because the login FQDN changes (which happens alarmingly often) you'll have all the fun of resetting your password. For no good reason. Re. portability, KeePass and its siblings are compatible with every major platform.
- Globz 9y ago
  I have access to my password manager at all time, thanks to https://minikeepass.github.io/ https://minikeepass.github.io/ on iOS! You can even sync your database to all of your devices by storing it inside an encrypted volume for extra security.
  - kutkloon7 9y ago
    Does this also work when you use someone else's phone or computer?
Lagged2Death 9y ago
...an attacker can use the knowledge of your password on site A to bruteforce your master password offline. This might be a concern if you're the victim of a state-level targeted attack. That's not a threat most of us have to deal with. Hackers aren't likely to spend a lot of effort cracking John Doe's password list; they want to steal a few million password hashes and sift out a few thousand easy or re-used ones. Your other points about the weaknesses of the scheme stand. Still, if we could get more users to use not-terrible, not-duplicated passwords, even with a flawed scheme like this, overall internet security would improve immeasurably.
- dublinben 9y ago
  You don't need to be the victim of a state-level targeted attack. You just need to be a public figure online[0] and attract the attention of a bored hacker. [0] https://www.theverge.com/2012/8/6/3224597/mat-honan-hacked-apple-icloud-google-twitter https://www.theverge.com/2012/8/6/3224597/mat-honan-hacked-a...
  - Lagged2Death 9y ago
    I'm not super familiar with the Honan story but I recall (and quick skimming seems to confirm) that it was more about lax security policies at Apple et al, the interconnectedness of social media accounts, and social engineering than it was about reversing a computed hash or human "hashing" scheme. Did those attackers guess or compute even one password at all?
    - dublinben 9y ago
      Not in this specific instance, but they could have. And that level of scrutiny would have enabled a complete digital takeover like Honan suffered if his accounts were poorly protected by a system of passwords proposed above.
- IncRnd 9y ago
  This is false. There are many types of targeted attacks on passwords that don't come close to including state-level actors. Divorces. Corporate Espionage. Any one of the people on Judge Judy who posted information online about their co-workers.
  - Lagged2Death 9y ago
    As far as I can tell, we're talking here about reversing a cryptographic hash and sifting the one true master password out from the much more numerous hash collisions. Do you really expect that level of effort to be common in a divorce?
    - 9y ago
kutkloon7 9y ago
You can add something (e.g. a number) to the end to make a different password. The idea is that you have a _very_ secure master password (so bruteforcing it is not practical - to make this even more true you could hash a huge number of times instead of just once) and never change it. There is still some truth in your arguments. I'm curious what you consider a good alternative?

l0b0 9y ago

Why on earth is this being downvoted? If you've used a hashing generator for any length of time you'll know how multiple master passwords inevitably creep in. Also, when your generator no longer works because the login FQDN changes (which happens alarmingly often) you'll have all the fun of resetting your password. For no good reason. Re. portability, KeePass and its siblings are compatible with every major platform.

Globz 9y ago
I have access to my password manager at all time, thanks to https://minikeepass.github.io/ https://minikeepass.github.io/ on iOS! You can even sync your database to all of your devices by storing it inside an encrypted volume for extra security.
- kutkloon7 9y ago
  Does this also work when you use someone else's phone or computer?

Lagged2Death 9y ago

...an attacker can use the knowledge of your password on site A to bruteforce your master password offline. This might be a concern if you're the victim of a state-level targeted attack. That's not a threat most of us have to deal with. Hackers aren't likely to spend a lot of effort cracking John Doe's password list; they want to steal a few million password hashes and sift out a few thousand easy or re-used ones. Your other points about the weaknesses of the scheme stand. Still, if we could get more users to use not-terrible, not-duplicated passwords, even with a flawed scheme like this, overall internet security would improve immeasurably.

dublinben 9y ago
You don't need to be the victim of a state-level targeted attack. You just need to be a public figure online[0] and attract the attention of a bored hacker. [0] https://www.theverge.com/2012/8/6/3224597/mat-honan-hacked-apple-icloud-google-twitter https://www.theverge.com/2012/8/6/3224597/mat-honan-hacked-a...
- Lagged2Death 9y ago
  I'm not super familiar with the Honan story but I recall (and quick skimming seems to confirm) that it was more about lax security policies at Apple et al, the interconnectedness of social media accounts, and social engineering than it was about reversing a computed hash or human "hashing" scheme. Did those attackers guess or compute even one password at all?
  - dublinben 9y ago
    Not in this specific instance, but they could have. And that level of scrutiny would have enabled a complete digital takeover like Honan suffered if his accounts were poorly protected by a system of passwords proposed above.
IncRnd 9y ago
This is false. There are many types of targeted attacks on passwords that don't come close to including state-level actors. Divorces. Corporate Espionage. Any one of the people on Judge Judy who posted information online about their co-workers.
- Lagged2Death 9y ago
  As far as I can tell, we're talking here about reversing a cryptographic hash and sifting the one true master password out from the much more numerous hash collisions. Do you really expect that level of effort to be common in a divorce?
  - 9y ago

kutkloon7 9y ago

You can add something (e.g. a number) to the end to make a different password. The idea is that you have a _very_ secure master password (so bruteforcing it is not practical - to make this even more true you could hash a huge number of times instead of just once) and never change it. There is still some truth in your arguments. I'm curious what you consider a good alternative?