<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>My approach is a bit more work, but it makes me feel safe despite
how theoretically easy it would be to break it.</p>
<p>I have a text file in an unlinked, and trivially password
protected, Web page. That file looks like a list of my passwords,
but it isn't quite. Each password in the file is a randomly
generated string, but what the attacker (except for you all)
doesn't know is that the actual passwords are those random strings
but with my own personal tweak. When I log in to, say, my bank
account, I copy/paste the string from the file into the password
field and then tweak it.<br>
</p>
<p>So the only way I'm screwed is if they find this file and figure
out my ttweak (and there's no clue that one is needed except that
the passwords don't work). Cryptographically unsafe, but it feels
pragmatically pretty safe to me, since you can break into millions
of accounts if you hack lastpass, but you can only get my accounts
if you hack this.<br>
</p>
<p>Somebody who doesn't have their own Web site could do this with
something like a google doc or google sheet.<br>
</p>
<p>And I also use 2FA for important sites as well.<br>
</p>
<div class="moz-signature">-- <br>
<p style="font-family: Times, serif">
Jon "I Don't Have To Outrun The Bear; I Just Have To Outrun You"
Dreyer<br>
<a href="http://www.passionatelycurious.com">Math Tutor/Computer
Science Tutor</a><br>
<a href="http://music.jondreyer.com">Jon Dreyer Music</a>
</p>
</div>
</body>
</html>