Search Hashnode

Search posts, tags, users, and pages

Comment by Chris Bongers on "Double Blind Passwords (aka Horcruxing)" | Hashnode

Chris Bongers

Looking to get into development? As a full-stack developer I guide you on this journey and give you bite sized tips every single day 👊

Dec 18, 2020

This Horcrux password is new to me, so did I get it right, you'll have your password auto-filled by 1password (or whatever) and then typo your addition to it (which was stored in your head)?

I use the following at the moment: 1Password (Master pass only in my head, very long and random) All passwords generated and unique 2FA for all-important apps with G2FA

To me, that seemed pretty solid because even if you'd get my 1Password you couldn't really get into the important part.

Phani Karan

Dec 18, 2020

Hey Chris

Yeah, you understood it right. The horcrux (stored in your head) is effectively a second factor.

Your password + 2FA usage is pretty secure IMHO. You can probably use a horcrux for websites that don't offer 2FA, or use it as a third factor for websites which do offer 2FA (3FA might seem a bit too much but to each his own I guess :)

AJ Henderson

Phani Karan Well it's also not adding a factor. 2 passwords is not 2FA. It has to be 2 different factors. A master password for a password manager and a mini-password are still just different version of "what you know" and are just a slightly more complicated single factor.

Software Developer

Dec 22, 2020