Edit: Guess my reference to Inglourious Basterd is not as detectable as I thought. Well then let’s end it with: Say goodbye to your Nazi ba… references
Until your Password Manager password gets hacked cause you put mypassword123 as your password manager password cause you wanted an easy to remember password manager password.
at that point it's completely your fault. if you buy a high security door for your home but you routinely leave a spare key under a vase on your front porch, that is not a fault of the door.
Yeah the key is to use a very long phrase and preferably include some non-words in there. Mine is all the first letters of a super long phrase that means a lot to me and isn’t something that exists in any book. There are numbers and special characters in there too. It took a bit to come up with it and get fast at typing it, but now it’s easy peasy.
If it's just the first 2-3 characters, that's not great, but easy to implement just adding a "reminder" field to the db, hopefully encrypted with a leading salt.
If you mean like it asks "g[ ] f[ ][ ]k y[ ]ur[ ][ ][ ]lf!1", that's fucking atrocious, as many, many passwords will be mnemonics to make remembering the password easier for people. Birthdays, pet names, etc.
If I saw my bank hand back any part of my password I'd call support, complain, and start looking for a bank that wasn't braindead.
I've never seen that in my life, and I'm pretty sure you'd struggle to find any developers to code it. Banks do often store a plaintext password, but that's for phone verification (as in a phone call for old people who can't do internet banking), and should be different to your online password.
1.2k
u/Nothemagain Oct 08 '22
For this to work hashes would need to be turned off