4 ms·
How does this method work for sites that require password changes every X days or sites that need a password change because they had a data breach?
by LordAtlas 6y ago
How does this method work for sites that require password changes every X days or sites that need a password change because they had a data breach?
- dheera 6y agoI have a stored parameter "n" that just increments the number of irritations of PBKDF2. That's a lot less to deal with than the amount of state in a traditional password manager, and I'm much less worried about losing it since it's likely I can estimate n for most sites even if I don't have it with me.
- klyrs 6y agoForced rotation always results in users using this "add a bit of junk" strategy. Both this strategy, and password rotation, are weak for that reason. And the whole point is that a breach of one site may expose almost-your password for many more sites.
- simonebrunozzi 6y agoYou could add a date (202101 for YYY-MM) to the string (domain URL or service name) before you apply your custom "hash" function.
- LordAtlas 6y agoBut then you would need to remember the date you changed your password for each site that needs it.