Hacker News new | ask | show | jobs
by drdaeman 3932 days ago
That's a very popular scheme.

The major downside is that site saying "your password must [not] contain blah-blah-blah"/"be N to M characters long"/"may contain only digits" when the generated one just happens to not conform to such restriction. In my personal experience, one out of dozen sites tries to be smartass about the passwords, so the scheme is a PITA in the long run.

Without the increment you also can't rotate password, while with the increment you need to store the increment value (and if you do keep the notes and the master secret, why not just remember the password already?)

The password managers are more flexible than password generators, because they don't have such limitations.

1 comments

I wrote my own hashing method [1] that given a correct spec for password restrictions would always generate a valid password. It does it by taking the hash in base64, then translating those a new set of base64 characters chosen to increase the likelihood of getting a valid password. If one generated is not valid, it then iterates until a valid one is found (by cycling the bits).

I have used this personally since I wrote it. Given the downsides, I agree that password managers are probably better for most people.

[1]: https://github.com/onionjake/doh