3 ms·
It's not good to reveal your scheme, or for your scheme to be so simple. If a HN database ends up in the open, your accounts on other sites become vulnerable.
by jmmcd 8y ago
It's not good to reveal your scheme, or for your scheme to be so simple. If a HN database ends up in the open, your accounts on other sites become vulnerable.
- bscphil 8y agoIdeally your passphrase would be secure enough that it couldn't be bruteforced from a (hashed) HN database. But in case a non-hashed database gets leaked, what sort of scheme could one use that couldn't be revealed from a single known password? I suppose one could use a system like bcrypt(passphrase + "domain.com")[:32] But anything requiring a calculation step seems to lose a lot of the advantages of a single-passphrase system.