3 ms·
This is, in my opinion, the best way (by far) to handle passwords for non-security-critical accounts. Came across this forum that you last visited 7 years ago?
by tjoff 14y ago
This is, in my opinion, the best way (by far) to handle passwords for non-security-critical accounts.
Came across this forum that you last visited 7 years ago? Remember the password? With this technique you will, without resorting to password managers - and still have a unique password on every site.
Remember not to make your salt obvious though. In other words don't just append the domain name in front of the password or it will be quite worthless. Instead take for instance the third letter in your password and let it be the second-to-last letter in the domain name (and do some further transformations), and you're good to go. You will remember the specific password for sites you go to often but for any site you will be able to "re-generate" the password in your head.
- bigiain 14y ago" … without resorting to password managers" What do you find so hard about "resorting to password managers"? For me, I reckon adopting 1Password has _reduced_ the amount of hassle dealing with passwords causes me. 95+% of every website login has become command-slash-return. Registering for new sites has added a single click to the "do you want to save this login" popup. Since I always carry my smartphone, I've _always_ got my passwords securely stored in my pocket, as well as on my Pad, laptop, and work machine. I find it hard to understand why people _don't_ use some sort of password safe software…
- tjoff 14y agoSo you write your password off your smartphone? And you call that reducing the amount of hassle? "command-slash-return" isn't acceptable security either, I must be able to lend out my computer without reducing the barrier to my online accounts. Also if I lost my phone (it breaks or get stolen) I must still have the freedom to be able to use the internet... Everyone I've ever met that to my knowledge uses a password manager has, in my presence, been limited by it. No way on earth I'd put up with that.
- bigiain 14y agoNo no, sorry - I wasn't clear enough. Let me clarify. Transcribing passwords off my phone is always available as a last resort (most commonly used at the terminal in the datacenter, so extremely rarely). Almost all password entry is autofilled (via browser extensions) or cut/pasted from the 1Passwrod app. "command-slash-return" - also needs my password safe passphrase (unless I've entered it in that last 5 mins and the machine hasnt slept or entered screensaver mode). My phone is only one of devices with synced copies of my password safe data. The only "limit" I've ever felt I've had since getting properly invested in using 1Password is that I now occasionally waste time having to "back down"from my default 16 random char passwords when somewhere won't accpet that length or charset.
- tjoff 14y agoWell, in cases where you can't (or don't want to) install browser extensions it is an astronomical limitation. Even without the cases of your phone being stolen/lost/battery-empty the hassle is just waay too much to even consider it.