I’ll do this later…

  • 7 Posts
  • 40 Comments
Joined 1 year ago
cake
Cake day: June 8th, 2023

help-circle














  • I do just that. This Yubikey is not just for websites though. I use it for apps too. Things such as my password manager, login credentials, encryption apps, etc. The idea of using it on websites got me thinking about using a base password and a seed for each app.

    Edit: I also want to use it for multiple computers that I have. I use those for things like NAS, Jellyfin, Pi-hole, etc. Mostly those are Raspberry Pis. Using a password manager I’d have to copy-paste or remember each password. Not all have a web interface.



  • Really? The example “bank+[40 character password]” was just an example. Obviously I wouldn’t use bank for my banking credentials. I was also under the impression that many websites and applications wouldn’t store or transmit plaintext passwords (I wouldn’t use http for transmitting credentials). I do concede that there is a news story every month about a corporation getting hacked and the user’s passwords were stolen and in plaintext so they could compromise me that way. But I don’t think hackers are really going after me because I’m broke. The government maybe. This is really just so I can have a convenient way to have a complex password. I can’t remember 5 different 15-20 character complex passwords.


  • I’m sorry. My original post did not convey my intentions adequately. The fact that I have to change my password every 3 months is what sparked my curiosity and question for my original post. For work I just generate a password using a password manager and store it on a Yubikey that I use for work purposes when I need to update my password. The question in the post is for a personal Yubikey. I started using a generated password on that one and wondered if adding a prefix password to it, changing the prefix for different applications, would be considered secured.



  • I may not have been clear in my original post. My work computer does have it’s own KeePass database. This question is for my use of a Yubikey on multiple sites. For clarification I use a separate Yubikey to store my work computer credentials that I back up to my personal Keepass database (can’t access the work database if I’m locked out). I do this because of the requirement to change passwords every three months and I don’t want to reuse the limited passwords I remember so I use a password generator.

    My question is with using a “prefix” with my personal Yubikey (the one I don’t use for work). Specifically, even if the last 40 characters is from a generator configured to generate a high entropy excellent quality password if I use that password with a different “prefix” (different lengths too) for different sites then would it really be compromised if one site gets hacked? They are different passwords, different hashes, different entropy. It’s just a large part is the same. I don’t know much about security I just want to know if this is a risk. I’m trying to move my security from something that I memorize to something that I physically have and know.



  • I prefer an MP3 player over my phone. Here is the one I use. Why I like this one:

    • Dedicated device designed for music.
    • Hardware designed to play high quality music. (Think using Ubuntu vs Ubuntu Studio for music production)
    • Dedicated buttons instead of all touch screen.
    • More options for integration with other devices or systems
    • No distractions. Phones nowadays demand our attention for every little thing. Every app, no matter what it is, has notifications.
    • The Bluetooth is better.
    • You can literally hear the difference in the quality of the music if you use good quality headphones/ear buds. The same song, same file, will not sound the same if it’s a good quality FLAC.