Every time I create an account on some new website, I find myself wishing for some kind of law enforcing disclosure of whether or not my password will be stored in plaintext or encrypted.
I got super paranoid about that, so I created a system for creating quasi-random passwords for different sites, but based on the same rule:
salt+[reversed first four letters of site name]+[number of digits in site name] not the actual rule I used, but you get the idea
That was okay, but kind of annoying. Plus, I figured that the rule wouldn't be overly difficult to break, and then I'd be just as screwed as if I used the same PW for all sites.
Now I use 1Password to generate and store all of my passwords. I use dropbox to sync it across all my computers, and if I log in to dropbox, I can access a web interface. There's also an iPhone app, so it's not completely annoying never knowing any of my passwords, and I don't have to worry about one site storing my PW plain text and being exploited. [Now I just need to worry about my dropbox account getting hacked... here's hoping they don't store in plain text ;)]
I don't have anything to do with 1Password, and there are a lot of other apps out there that do the same thing.
Yep. Of course the security-minded (read: paranoid) people still cringe at schemes like this (the password generators mentioned above are more secure), I think this is a pretty good compromise for the average person.
