Comment by EVa5I7bHFq9mnYK
4 years ago
"long sequence of words that are trivial for me to remember"
I also thought so until I suddenly forgot a master password I have been using for several years. Luckily, I was able to recollect it after several days. Then, I forgot it again.
Age, decease and head trauma can happen.
By "long sequence of words that are trivial for me to remember" I meant concatenation of secret questions, like in the bounty example: https://mprimi.github.io/portable-secret/examples/bounty.htm...
Unless I hit my head really hard, there's zero chance I will forget this passphrase.
Keys should be random. The hints make it too easy. Lets say there exist 100 male names and 100 female names, thats just 100*100 combinations for names part. You could make the key generation intentionally slow though to limit the crack speed.
> You could make the key generation intentionally slow though to limit the crack speed.
Am attacker keen enough to bruteforce can easily copy the ciphertext, IV, and salt to a tool that doesn't have a slowdown. Or, just modify the JS to remove the artificial slowdown.
1 reply →
This is an old problem: how to slow down the hashing. https://en.wikipedia.org/wiki/Bcrypt
> decease
That one makes passwords vanish from ones memory quite effectively.