Opinions of qwertycards.com?

[Lodewijk andré de la porte]

"The 'site name' code ensures that all of your passwords are unique. This
protects you from having all of your passwords compromised by a security
lapse on any individual website."

Totally untrue. If any of the websites has failed to do proper password
hashing (or you password is intercepted due to keylogging, bad HTTPS, bad
remote host, etc) then the security of all your passwords will be VERY low,
depending on the length of the site's name. This is because the beginning
of the password is constant, and the latter part is a (partially
discovered) substitution.

Still, for "ye olde user" this isn't that bad. Could easily be improved
with some sort of substitution-ring-scheme, where you have various
substitutions and select the substitution based upon the website's name.
Shouldn't be much more expensive, but could be a bit bulkier (or less
readable hehe).

Would've been much cooler if they had actually put a display on the thing,
and made it hash the constant key, user secret and website name together.
But the price would be higher, so Yubikeys and the like enter the picture.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1216 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks/attachments/20150429/cdb330db/attachment-0002.txt>