Re:GoToMyPC has been hacked, all customer passwords reset
by brillenfux on Sunday June 19, 2016 @08:06AM
(#11932693)
Somebody has told me, that this would be bad because "something" (I think entropy?). I didn't understand that.
Can somebody with sense please explain if this is a good or bad idea?
Re:GoToMyPC has been hacked, all customer passwords reset
by tacostakohashi on Sunday June 19, 2016 @08:23AM
(#11932736)
It's not a terrible idea, but it does fall apart if you need to change one of the passwords (say, because you were using this strategy for a number of services including gotomypc). Now you need to have multiple master passwords, or you need to increment the service name (gotomypc2?), and then you're remembering the increment as well as the service and master password.
It's a cute trick, but I don't think it really scales well for the number of accounts we tend to have these days, and the frequency with which passwords must be changed due to hacks, password aging policies, validation ("must have 1 punctuation character"), etc.
As for entropy, it's limited by the master password, and whatever obscurity the hashing and service name provide. If you have a short master password, you're not getting the as much uniqueness as you might think by looking at the length of the hash output.
Re:GoToMyPC has been hacked, all customer passwords reset
by jhasse on Sunday June 19, 2016 @08:13AM
(#11932710)
It's a good idea if you're using a secure secret or if an attacker doesn't know your exact method.
EDIT: it is best to write a script for this