Hacker News Reader

As a half-way step, they could aggregate and normalize the various stupid rules that sites impose and then automatically generate valid, maximally secure passwords by default. Eventually, 1Password (or similar) could handle e.g. changing them all on a given schedule. I already try to have no passwords older than three months, and it's a PITA.

View on HN

Problem: Aggregation and normalization might result in an empty set as contradictory rules prevent harmonization.

I think the parent comment is saying that 1Password would record the rules per site, not maintain a global list of rules that satisfies all sites. The latter would indeed yield an empty set, as some sites require a special character and some require no special characters.

Yes, exactly; for each site that 1Pwd can recognize as distinct, record the restrictions. Even share these restrictions. And perhaps people could put attributes on their password entry elements (or header metadata) that would describe the limitations of their password systems, so it wouldn't be specific to any one password manager; then, too, they could retire their terrible, terrible, terrible client-side strength checking crap.

Reply on news.ycombinator.com