this post was submitted on 15 Jun 2023
23 points (100.0% liked)
Technology
37800 readers
306 users here now
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I actually see myself being able to use this password manager; although it really does require that you approach passwords with a much different paradigm.
Depending on the behavior of this generator we can always vary our input for #5 and, maybe vary the input for #4. I don't know if it allows us to manipulate #3 after initial input though.
If 3 and 5 are variable with each use and 4 is auto-detected through software means, and stapled to the domain name value, then we already have two factors of information and we can use two 'passphrases' to derive one. You could insert a nonce into your First Name or Master Password. Maybe you only change the nonce word in your Name when making accounts for different purposes and change the nonce word in your Secret when a site needs a new password.
Full Name: First <Nonce> Last
(change the nonce to change the account selected)Master Secret: Password <Nonce>
(Change the nonce only when you need to kill the old password.You remember: The Name, Secret, the Name Nonce and, the Secret Nonce. (This compresses down to three things if the nonce is same for both because the account has never been breached)
If only 5 is variable after initial setup and 3 is written only once and 4 is automatically determined; we can still vary the input of that to increment the passwords. You just have to add a nonce value or counter to your master password:
MasterSecretHere <Nonce>
You remember: Master Secret and the Nonce. Maybe you have to remember if you've changed the Nonce for this website if it's been breached.
If all three values are input to generate the password by you; then you have complete control over the generated password. You can insert your nonce into any, some or all of the values to change the desired password output.
Your remember: All three base inputs; Full Name, Site Name, and Master Secret. You may use as many or as few nonces as needed and you can make them memorable.
(Maybe Bad) Nonce Examples: (Please; be more creative than these nonces; these are only here to explain things.) [Please note that all names, sites and passwords/secrets presented are fictional and used only for example purposes. Do Not Use any of these examples as your own password generation inputs]
First (Assumes Name and Secret can be variable; but not site name)
Harry Muggle Dresden
In this case; we use 'Muggle' as a memorable nonce to select his "Muggle" or "ordinary accounts" for handling his real life stuff like bank passwords.somewherenationalbank.com
We assume this is set by his helpful browser plugin and he's never had another account here; so we choose not to add any nonce here (if we even could).Abracadbra-Alpha
Here we follow a simple nonce list; since we haven't needed to change the password yet; But if for some reason the bank gets a wild hair up it's rear end and requires a new password; we would just cycle through the list of nonces as follows;Alpha, Beta, Delta, Gamma, Iota, Kappa, Omega
Second (Assumes only the Secret is variable)
Harry Milford Dresden
spicymeatballsubsanywhere.com
Alakazam!Alpha
He knows those nasty heckers at the FBI has been trying to snoop on his secret sub orders...so he's using a different Secret base;Alakazam!
to throw them off and prevent hacking. He would still just cycle through the list of nonces as follows;Alpha, Beta, Delta, Gamma, Iota, Kappa, Omega
...if the password needs changing.Third (Assumes all three can be input at each password creation/retrieval)
Harry <Purpose> Dresden
You see; he's a Wizard; so for times he's being a Wizard for a client he usesWizard
, when he's enforcing magic law he usesWarden
and when he's doing mafia work he's usingWinter
to replace the token.<Username>@<domainname.tld>
This should be obvious but this encodes his username and site name here.<Passphrase>:<nonce>
Pretty easy; he has a different passphrase for each purpse; all secret of course; and if a site gets hacked he changes the passphrase; if a site just needs a new password he changes his nonce by just cycling through the list of nonces as follows;Alpha, Beta, Delta, Gamma, Iota, Kappa, Omega