Re:Show HN: Evilpass – A slightly evil password strength che...
by dheera on Saturday February 18, 2017 @09:34PM
(#13677885)
One option would be to host a public text file (on Github, even) that describes various services, their password requirements, domain aliases, and have the script tack on the approriate strings based on the public text file. Others could even use the same script and submit pull requests describing new services they encounter.
My main objective is to eliminate personal databases.
Re:Show HN: Evilpass – A slightly evil password strength che...
by Kliment on Sunday February 19, 2017 @06:23AM
(#13679200)
Okay, so say I submit a pull request for a phishing domain pretending to be an alias of something, and months/years later trick you into visiting it. Seems risky to me.
Re:Show HN: Evilpass – A slightly evil password strength che...
by dheera on Sunday February 19, 2017 @12:03PM
(#13680621)
This would only be risky if I got phished into visiting your phishy domain AND was stupid enough to consciously want to enter a password into it, in which case the risks are the same as if I used a human-memorized password.
My password "manager" doesn't automatically fill in passwords until I consciously ask it to.
But some amount of human oversight over those pull requests would be in order.
1. it's not always clear what the domain is. Sometimes a company has more than one portal to enter a login. Now I have to remember which one I was using when I created the account. I can try to use the company name but that's ambiguous as well because sometimes the portal's or product's name is different from the company's name and now I have to remember what the "domain" is.
2. Different services have mutually contradictory requirements for passwords. You mentioned you add '$1Aa' to appease some websites, but I have encountered ones that have a no symbols rule, or some that have minimum length 12 while others that have maximum length 10.
I believe the most reasonable solution is to use a password manager.