News for hackers. Stuff that matters.
Re:Double Blind Passwords a.k.a. Horcruxing by TwoBit on Tuesday December 22, 2020 @04:26AM (#25504488)
> attacker can create a website and ask you to join it under the hope you'll reuse your horcrux on the attacker's site.

I don't think that reusing the same pepper (horcrux string) for all sites would be best practice.

Re:Double Blind Passwords a.k.a. Horcruxing by toasted_flakes on Tuesday December 22, 2020 @04:38AM (#25504550)
If only we had a secure place to store all of the horcrux strings that are unique per-website!

Joking aside, I don't see the point of this. It guards against exactly one attack (your password manager somehow revealing all your passwords) which is unlikely, but not against a whole lot of other (slightly more generic malware, phishing, ...) whilst making logging in harder (there's now a manual process).

If you're willing to go such lengths, enable 2FA on more accounts (which the articles mentions, points for that) or get a physical token for your password manager.

Re:Double Blind Passwords a.k.a. Horcruxing by djeiasbsbo on Tuesday December 22, 2020 @06:00AM (#25505038)
That might be likely if the password manager database is stored in the cloud. iCloud hacks seem to be at least somewhat common and iOS users often hsve no other means of syncing their password manager database.
Re:Double Blind Passwords a.k.a. Horcruxing by gruez on Tuesday December 22, 2020 @11:30AM (#25507954)
Isn't that a non-issue if the cloud version is encrypted?
Re:Double Blind Passwords a.k.a. Horcruxing by starfallg on Tuesday December 22, 2020 @05:14AM (#25504756)
That defeats the point of using a password manager more or less. You're just remembering individial passwords but it's even more complicated now.
Re:Double Blind Passwords a.k.a. Horcruxing by ska on Tuesday December 22, 2020 @12:35PM (#25508851)
That's ok - just use two different password managers and merge the parts manually on login ;)