>Basically, I added a concept of an `nonce` property, which is just a number that gets incremented every time a password for a service has to change.

So your solution to issues with stateless password managers is to... add state?

In a sense, but not state that gets stored anywhere. The "state" that's being mentioned in this thread is referring to storing state in some kind of database. My idea was to not require storage of state outside of the human mind, and to make any state easily guessable(by the owner) through exhaustive search.

Even Lesspass uses an incremented number for that purpose, from what I can tell. So it adds state in the sense that you're talking about.

> It looks like Lesspass also uses a counter property. Kinda amazed that two people independently arrived at such a similar idea. :)

The system I made "sinkless" https://github.com/kybernetikos/sinkless does the same thing. Its a pretty obvious solution to the problem of needing to able to change passwords, and it also solves situations where sites have crazy extra restrictions that can't be reduced to just the alphabet. My system also shows you emojis so you know when you've got your password and site settings right.

Most of the other complaints are also over blown, but the lack of 2fa is a genuine loss.

I had a similar intent for less important accounts (I would keep using a more secure but less convenient solution for more significant credentials). To shortcut guessing the index you could store just the site plus index in a cookie or similar - if that data is lost you can still use the guesswork option. If tracking is a concern so you don't want site names to be stored, has the site name and index and use that to build a bloom filter (not perfect, but it will usually guess right without storing the actual data). Though for my use I wouldn't care that the site names were known.

Another similar idea to stop people using the "just add a character or increment a number" method for dealing with passwords that need to be changed monthly. The password is based upon a hash of master+site+year+month+salt. You are still compromised if the master password is compromised, it is never any worse than what people do already. Again I'd not use this sort of thing for truly important accounts.

> Kinda amazed that two people independently arrived at such a similar idea. :)

I've seen many similar schemes, some identical to those I've considered and either dismissed of not found time to think through, some with minor variations. I think this is a problem a lot of people encounter so it is a common though-game, so I'm not surprised that for every combination of tricks there are a number of people who have thought the same (or even got around to implementing something).

that would be an epoch, not a nonce. it’s still awful