Comments on: What is a Double Blind Password? Password Manager Hack 2025

By: Michael

Michael — Mon, 08 Nov 2021 14:28:39 +0000

I’m a big fan of the double blind password idea. I do however have one concern. Does using the double blind password prevent 1Password or any other password manager from detecting if your password has been compromised?

I’m not sure how password managers detect a hacked password, but if they don’t know what the password is, how can they detect that password has been compromised?

Thanks

P.S. Are you still using 1Password? One of your videos indicated that you might be using a different password manager like dashlane.

I also wantEd to mention that i have posted this question on youtube, but it alwaYs disappears. Is this the best way to conTaCt you?

By: Josh

Josh — Thu, 22 Jul 2021 06:47:42 +0000

In reply to chris. Great thoughts here, Chris. Thanks for sharing!

By: chris

chris — Sun, 18 Jul 2021 21:31:12 +0000

google “strong password generator plus” and use that to create unique usernames and passwords. Also, you will want to see what info the website needs to reset your password if a hacker just goes the route of stating they forgot the password. Sometimes it is as simple as emailing you a link, so then your email account becomes the most important password you need to contain (use mfa to secure email). other times the forget password link might ask for your answer to a security question. i always answer my security questions with some set formula using the characters in the question and an additional passphrase tacked on, such as “Where were you born?” Answer: wn5892 (used first and last letter of question along with a number that has meaning to me). Don’t ever answer security questions with the real answer, or your double-blind password will be as simple as somebody looking up where you were born. use mfa as a second line of security, and don’t ever have websites remember your device to skip the mfa. as a third line available on some sites, have a text alert sent to your phone for each time a user logs into your account. i have an alert for each time a purchase is made on any of my banking/credit cards as well. just a few suggestions.

By: Allan

Allan — Fri, 04 Jun 2021 21:30:10 +0000

Hi, sorry just one question please: Is it possible to have 2 factor authentication only apply for selected accounts eg for say bank accounts but not everything else?
Thank you.

By: Allan

Allan — Fri, 04 Jun 2021 21:16:48 +0000

In reply to Josh Summers. Hi Josh - many thanks for you're response. Yes, I think 2 fac tor authentication is the way to go. Regards.

By: Josh Summers

Josh Summers — Wed, 02 Jun 2021 08:49:46 +0000

In reply to Allan. If somebody has direct access to your computer, they still won't be able to see the password 1Password puts in or the extra digits, but theoretically they could just reset the password via your email account if it was open on the computer. This is one reason why I recommend using 2-factor authentication where available. This is not "reset-able".

By: Allan

Allan — Wed, 02 Jun 2021 07:50:23 +0000

Hi
I’m an OLDIE and purchased 1PAssword manager but a bit confused on something. 1PWM creates a new password which is great but my original password is still available for me to use if i wish if i say to the site that i’ve forgotten so can then change. is the only thing that’s really protecting me is that someone with access to my computer wont be able to see the long-on and password used because i’m not manually entering the password but 1PWM is doing behind the scenes? Is that the benefit? I also read above about someone who’d used double blind and he didn’t think it had saved the extra digits but in fact it did – am I right here? I want to use for my bank etc so do I need to turn off auto save in the account ? Thanks.

By: Mike A

Mike A — Sat, 01 May 2021 18:52:53 +0000

In reply to Josh Summers.

josh, thanks for your reply.

i am using the Firefox lockwise password manager at the current time (i plan on updating soon). i just investigated the issue and found that the lockwise password manager created an entirely new entry with the full password and no userid (not sure why unless maybe the url was a bit different. many of these sites just redirect you to the new site). the new password was never saved in the original password manager entry. I had to copy and paste the new password without the 5 extra digits in the original password manager entry. that should have given me pause as to why it didn’t change but being the first time i tried it i thought that maybe i had just done something wrong or out of order. that’s also why the full password from the new entry was already in when i reentered the site to test the new password.

i deleted the original password manager entry and edited the new entry by entering the userid and removed the 5 extra digits (like i thought would have to do the first time and now when i go to login the site it brings up the correct password and then i have to add the 5 digits as you do in the article.

Bottom line is that the password manager creating a new entry with the full password in lieu of updating the existing one in password manager entry threw me off, otherwise, your method worked exactly as intended.

thanks again for your response and helpful security tips.

mike

By: Josh Summers

Josh Summers — Fri, 30 Apr 2021 14:58:34 +0000

In reply to mike a. Thanks for the heads up, Mike. Are you sure that your internet browser isn't automatically saving your passwords as well?

By: mike a

mike a — Thu, 29 Apr 2021 20:06:50 +0000

I tried this on one of my financial sites. I had the password manager create the password and then added a 5 digit unique ID at the end. the prompt box came up asking to save the password so i did thinking i could go then into the password manager and remove the last 5 digits.

i went into the password manager and it never saved the password with the 5 extra digits i added, only the password that was generated ( not sure why) but that is what i wanted anyways.

when i logged back into the site it had saved password including the 5 extra digits (good) but that 20 digit password was already in the password box so i didn’t have to input the unique id. i’m not sure why the 15 digit password stored in the password manager wasn’t automatically put in the password box in lieu of the full password stored by the site. now i have to remember not to add the unique ID to the end of the password on that site.

bottom line is my password manager has a 15 digit password and the site has a 20 digit password, exactly how i wanted it, but i don’t have to add the extra 5 digits because somehow (i’m assuming the site puts them in) they already there.

pay close attention to how your new secure password is saved and what is being saved by the site, by the password manager and if you do or do not have to enter a unique id to enter the site as it may already be entered for you.