Re: [gentoo-user] Coming up with a password that is very strong.

[Dale]

Tanstaafl wrote:
> On 2/4/2019, 8:10:57 PM, Dale <rdalek1967@×××××.com> wrote:
>> Tanstaafl wrote:
>>> I've been using a little Firefox Addon called Passwordmaker for many,
>>> many years, and despite all of its warts, I've been loathe to give it
>>> up, even though it will never be upgraded to work as a WebExtension.
>>>
>>> 2 things I loved about it -
>>>
>>>  a) it doesn't save the password locally, only info about the
>>>     site/account, and
>>>  b) you can use an unlimited number of Master Passwords
>>>
>>> I'm looking at migrating to KeePassXC, and even though I really hate the
>>> idea of saving the actual password - Passwordmaker simply generates the
>>> password on the fly each time based on certain specified criteria (ie,
>>> the site URL, username, password length, etc for each account - one
>>> technique I adopted shortly after assisting in updating the
>>> Passwordmaker website eases my mind about it...
>>>
>>> This is a simple technique I strongly recommend that everyone employ,
>>> especially if you use a Password manager (like LastPass or KeePass)...
>>>
>>> It is uncrackable (well, as long as it isn't the CIA or NSA that wants
>>> to crack it and they are willing to kidnap/torture you to do so).
>>>
>>> You sit down and come up with a ... call it a 'password modification
>>> protocol' ... whereby, you always modify your generated/stored password
>>> in a specific way before pressing enter.
>>>
>>> For example, you delete characters 3, 5 and 7, then add 2 characters to
>>> the beginning and 2 to the end.
>>>
>>> It is very simple, and negates worrying about someone stealing your
>>> password vault.
>> I tried to find it just to see how it works but it isn't listed.
> What... Passwordmaker (the old one I still use and why I keep an old
> Firefox 56 portable version around)?


I'm on the newer version of Firefox so it doesn't show up in my search
since it isn't compatible.  I'm pretty sure that is why it doesn't show
up for me.  If I were on the older version of Firefox, then it would
show up.  I was wanting to look at it tho.  I did find a Pro version
which is likely the same thing but for the newer versions of Firefox. 
Did you see it?  It is here:

https://addons.mozilla.org/en-US/firefox/addon/firefox-passwordmaker-pro/?src=search

I see another version as well but with very few users.  Still, if the
above is just a version for the newer Firefox, you may not have to
switch or can use both somehow.  Some other add-ons I use did similar
things.  Since some required a complete rewrite, they also changed the
name a bit too.  Thing is, some of the new versions of add-ons don't
show up in older versions of Firefox.  If you didn't see this, I hope it
helps.


>> From what you wrote, you may want to at least check into LastPass.
> I did a massive amount of research (including LastPass), and settled on
> KeePassXC for a good reason.

I've read where people use that and like it.  It just depends on what
you are looking for and expect from the tool.  If it meets your needs,
then it is a good fit for you.  I picked LastPass since it did what I
need and then some plus is free.  I also had the privilege of emailing
back and forth with one of the original owners or creators way back
then.  His name is Joe Siegrist.  My bank and credit card sites wouldn't
work at first.  I gave him a link and he made some changes so that the
next version would fill those sites.  I may switch one day, may even
switch to what you are using, but at the moment, LastPass seems to be
doing well. 


>> Still, I'm sure there is a tool that will suite your needs.
> ? Its like you didn't really read my email. I already said, I'm
> migrating to KeePassXC. But my complaint is, nothing works like
> Passwordmaker (again, it doesn't store passwords, can only use one
> Master Password).
>
>> I'm not sure I understand what you mean password modification protocol. 
>> It sounds like you change your master password each time you use it.
> No, I'm talking about the saved (or in Passwordmakers case, generated)
> password, not the Master Password.
>
> Doing this with the Master Password wouldn't make any sense.
>

If I understand you correctly, I think I have seen a site that allows
that sort of thing.  I think.  To be honest, this is why I like tools. 
I tend to let tools do the heavy lifting.  My biggest responsibility is
having a good master password.  That's what started this.  I want a good
one.  ;-)  Most of the sites I use are email or ID plus password.  A
couple have this picture and phrase thing between login and password
tho.  There is also a couple that uses that secret question thing.  Some
of those are plain annoying tho.  lol

Given how things are nowadays, I suspect we will always be in a constant
race to try and stay ahead of hackers and such.  Every time we change to
try and beat them, they will find new tools, faster hardware etc to beat
us.  The biggest thing, our tools or us have to keep up.  I really need
to keep up with the newer stuff better but to be honest, time just isn't
that available to me right now. 

I wonder what hackers will come up with next.

Dale

:-)  :-)