3 ms·
Most of my passwords never need to be typed onto strange machines, so I can use 1Password with long random complex strings. If it is a password I need to type,
by blowski 9y ago
Most of my passwords never need to be typed onto strange machines, so I can use 1Password with long random complex strings.
If it is a password I need to type, I use diceware "Correct Battery Horse Staple" style passwords. If I don't remember the password, I always have my phone, where I can retrieve the password from 1Password. There is no relationship between my different passwords. As long as my password vault is secure, so are all my passwords.
With your system, if I learn your master password and hashing mechanism, I basically have all your passwords.
- notzorbo3 9y agoFYI, diceware has been shown to be insecure with three words. Four is better, but also crackable by an attacker with a few thousand dollars to throw at it. Five and up is safe for the next few years.
- kutkloon7 9y agoTrue! So you have to choose a good master password and use an expensive hash. On the other hand, if you take any other approach, you place either confidence in the security of a service (1password), or you store passwords somewhere. In both cases, you have a problem when you can not retrieve the passwords anymore. If 1password is hacked or simply offline, or your phone gets stolen, you basically lost access to all services.