4 ms·

To verify, you're using a password manager? Because it's hard to imagine someone getting upset over having to just update an entry, and obviously the bank can't

by oehpr 5y ago

To verify, you're using a password manager? Because it's hard to imagine someone getting upset over having to just update an entry, and obviously the bank can't tell you not to use a password to unlock your own vault. And I can't imagine someone memorizing a password for a bank login only, and never using that in other locations. The internet requires so many accounts to manage... If you did reuse your password then your bank login would be very vulnerable to credential stuffing.

PaulHoule 5y ago
I use securely generated passwords based on a cryptographic hash. I don't use a "password manager". Someday 10^8 people who use a password manager are going to get their passwords stolen in one night and I'm not going to be one of them.
- oehpr 5y ago
  Most password manager ecosystems consider this vector. They're either zero knowledge (bitwarden, lastpass ...), local(keypass, pass, buttercup ...), or are vulnerable in the way you describe and suck. Hashing is sure an interesting way to create passwords. I've considered it as well. I liked that it protects you from credential stuffing and it's stateless. But I found it hit practical roadblocks I couldn't route around: * you need a plaintext that wont change at the site, but will change across sites. URL is most common, but URL's can change. * if that site does have password requirements and your digest fails to meet those requirements, you have to either iterate or alter your plaintext (and remember) or alter your digest (changes everything), or alter for that specific site (and remember). * sites often have password rotation requirements because users frequently use bad passwords across sites and that basically forces you to remember state. * If you store any of this state, it's no longer stateless and you hit all the problems of syncing across devices and so on and so forth. What do you use for your plaintext anyway?

by oehpr 5y ago

PaulHoule 5y ago

I use securely generated passwords based on a cryptographic hash. I don't use a "password manager". Someday 10^8 people who use a password manager are going to get their passwords stolen in one night and I'm not going to be one of them.

oehpr 5y ago
Most password manager ecosystems consider this vector. They're either zero knowledge (bitwarden, lastpass ...), local(keypass, pass, buttercup ...), or are vulnerable in the way you describe and suck. Hashing is sure an interesting way to create passwords. I've considered it as well. I liked that it protects you from credential stuffing and it's stateless. But I found it hit practical roadblocks I couldn't route around: * you need a plaintext that wont change at the site, but will change across sites. URL is most common, but URL's can change. * if that site does have password requirements and your digest fails to meet those requirements, you have to either iterate or alter your plaintext (and remember) or alter your digest (changes everything), or alter for that specific site (and remember). * sites often have password rotation requirements because users frequently use bad passwords across sites and that basically forces you to remember state. * If you store any of this state, it's no longer stateless and you hit all the problems of syncing across devices and so on and so forth. What do you use for your plaintext anyway?