3 ms·

That's very nice, well done! For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so

by sakisv 4y ago

That's very nice, well done! For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so mechanically when I'm on my laptop, that I really struggle to remember it when I have to type it on a screen - to the point that I must go sit at a computer open a notepad, let muscle memory take over and then look at the screen to see what I typed /facepalm Anyway, in all seriousness, while this is a scenario that happens very rarely, it still makes me wonder if it would be possible to do the pasdwordless login the other way, i.e. authenticate the phone using a trusted laptop (maybe a fingerprint enabled one)?

zem 4y ago
i use a regular english sentence as my master password; seems to strike the right balance between not brute-forceable and easy to remember. am i missing some potential drawback to doing that?
- ReaLNero 4y ago
  One thing to consider is that you can infer your password structure by ear (e.g. how many times the space bar was used, any modifier keys), making dictionary attacks much scarier, especially if your threat model includes people in close proximity/public areas.
- sandworm101 4y ago
  >> am i missing some potential drawback to doing that? My work machines (government) check for "commonly used words" and will generally reject natural language even if squashed between punctuation marks. "P@ssword" would probably slip through, but "GodIHateRememberingAllTheseStupidPasswords!@#!@" doesn't.
Fervicus 4y ago
Ha! I can definitely relate. Takes me 3-4 tries to get the password correct on mobile, and not so rarely I have to type it on the computer first.
- Rodeoclash 4y ago
  I'm in exactly the same boat. Incapable of typing my master password on a mobile screen because it's just muscle memory. I've had times where I've needed to get into my account in a hurry and had to find a POS terminal with a keyboard so I could activate the muscle memory.
trog 4y ago
I just have the master password saved in my browser. I realise this is probably sub-optimal for a lot of people but for my workflow (i.e. the kinds of passwords I put in BitWarden) it works out OK.

by sakisv 4y ago

zem 4y ago

i use a regular english sentence as my master password; seems to strike the right balance between not brute-forceable and easy to remember. am i missing some potential drawback to doing that?

ReaLNero 4y ago
One thing to consider is that you can infer your password structure by ear (e.g. how many times the space bar was used, any modifier keys), making dictionary attacks much scarier, especially if your threat model includes people in close proximity/public areas.
sandworm101 4y ago
>> am i missing some potential drawback to doing that? My work machines (government) check for "commonly used words" and will generally reject natural language even if squashed between punctuation marks. "P@ssword" would probably slip through, but "GodIHateRememberingAllTheseStupidPasswords!@#!@" doesn't.

Fervicus 4y ago

Ha! I can definitely relate. Takes me 3-4 tries to get the password correct on mobile, and not so rarely I have to type it on the computer first.

Rodeoclash 4y ago
I'm in exactly the same boat. Incapable of typing my master password on a mobile screen because it's just muscle memory. I've had times where I've needed to get into my account in a hurry and had to find a POS terminal with a keyboard so I could activate the muscle memory.

trog 4y ago

I just have the master password saved in my browser. I realise this is probably sub-optimal for a lot of people but for my workflow (i.e. the kinds of passwords I put in BitWarden) it works out OK.