3 ms·
Counter is so that you can rotate passwords. If a site forces you to update to a new password, you increment the counter. But now you need to know how many tim
by phamilton 7y ago
Counter is so that you can rotate passwords. If a site forces you to update to a new password, you increment the counter.
But now you need to know how many times a particular site has forced you to change your password.
- dheera 7y agoI have a similar stateless password manager I wrote. I just store the counter in a JSON file along with other parameters, e.g. Baidu doesn't allow passwords >16 characters, usps.com doesn't allow symbols, some other sites require symbols, some require a number, some require a number but don't consider 0 to be a number, etc. All of these things, including the counter, don't particularly need to be securely stored and can just be in a file in a git repo or Dropbox. Not needing to be securely stored eliminates many of the concerns with stateful password managers.
- TheDong 7y agoAn encrypted password file, such as a 1password or keepass database file, also doesn't have to be stored securely and can just be stored in git or dropbox or whatever. You're trusting crypto to not be broken either way, why not trust an encrypted file that provides significant usability rather than an unencrypted file and "stateless" generation algorithm?