Hacker News new | past | comments | ask | show | jobs | submit login

Do this instead https://spectre.app/



How does one handle password rotation requirements?


Doesn't that make your passwords predictable? If you use the same secret for every domain and now if an attacker figures out your one secret then they would be able to find out all your passwords.


How is that different from any other scheme which uses a master password?


A master password is at least generating random passwords though and encrypting the passwords themselves. Let's say your master password gets compromised, but not the password database itself... then attackers would still have no way to access your other passwords. With the method being described, simply obtaining the "secret" makes other passwords known without even needing access to the password database itself.


What do you when a generated password doesn't meet a web site's requirements (on length, character classes etc)?


oh that's cool. what I do is similar except simpler, much so.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: