4 ms·
How do you generate a different password after that one's been found to be stored in plaintext and the admin resets all of the passwords? Or, and more to the p
by andrewaylett 11y ago
How do you generate a different password after that one's been found to be stored in plaintext and the admin resets all of the passwords?
Or, and more to the point, having generated a different password how do you remember which sites need a V1 password and which need V2?
When sites introduce silly rules around password structure, how do you make sure your passwords conform?
And even if you could guarantee you'll never hit any of these issues, shouldn't you be using a key-derivation function, rather than a hash?
I entrust my passwords to KeePass, as I trust its authors to have more of a clue than me and it lets me store arbitrary data rather than restricting me to a specific class of generated password. That file can then be replicated to enough of my devices that it's available when I need it, without a third-party having enough access to the data to be able to issue even the kind of security alert we see here.
- dragontamer 11y ago> Or, and more to the point, having generated a different password how do you remember which sites need a V1 password and which need V2? > When sites introduce silly rules around password structure, how do you make sure your passwords conform? Store _THESE_ rules in a central database. Not the passwords. Those rules can be public at no cost to security to the end user. But LastPass, KeePass, OnePass and all sorts of Password generators store the actual friggen password, instead of salts or public information (like "5th password on gmail")