Comment by ojilles | Hacker News Reader

Comment by ojilles | Hacker News Reader

So what happens when your master password gets exposed? You get to go to every single site and change your password? How do you even know which sites you have accounts?

I think I'll stick with 1Password and completely random passwords. F.ex. with LinkedIN, I just need to change one password (and I have a database of passwords telling me where I have accounts, comes in handy too).

Speaking of LinkedIN, how would you change your password there? (since password = salt (based on domain name) + hashing function + master password; how do you change it?!)

The inability to change password without a new master password is imho very good point, which renders these kind of systems unusable. I'm not sure how that issue could be fixed without resorting to a (centralized) database.

This is one problem I encountered while using YPassword. My MobileMe password was compromised, then to change it, I simply added a parameter (the number of the password).

The new password is then

  hash ( masterPassword . url . number )

So now you need to remember a) masterPassword and b) the number. Basically, two passwords. That seems backwards to me... or am I missing something?

Reply on news.ycombinator.com