4 ms·
I meant my first comment in jest. I will consider your advice, but I imagine switching from one password manager to another will only certify me as a genuine an
by squiggleblaz 6y ago
I meant my first comment in jest. I will consider your advice, but I imagine switching from one password manager to another will only certify me as a genuine and eternal password hater. (Also, a password stored in a password manager is something you have, not something you know, so it's completely inconsistent with the principle of MFA. I mean, the reasons to hate passwords just increase as long as I think about it. That probably only hurts the theory of passwords though, not the practice of them.)
- hnlmorg 6y agoThere is another option if you wish to adhere to the principle of "something I know" and that's to generate a base64 key. eg SITE="www.example.com" SALT="passphrase" printf "${SALT}${SITE}" | shasum -a 512 | base64 | cut -c -25 (Though you're better off using some online tool that converts SHA 512 to base64 directly since the example above converts the ASCII string of a hex representation of the SHA 512 hash into base 64. So use that example above more as a visual representation) This will generate a non-reversible password with an entropy of 25^64 but it is re-creatable on any system that can display a web page and the password is not stored anywhere (so it's firmly "something you know"). If the password becomes compromised then you change your salt and a new unique password will be generated. Thus you only need to memorise a small subset of salts rather than a password per site. This was how I used to do passwords several years ago before I gave into the convenience of password managers.
- squiggleblaz 6y agoYes, I guess that theoretically works. As you say, it's much less convenient than abandoning "something I know" and just going for a password manager. Which I do.