Recent hacks of PayPal, Norton, LastPass (see [1-4]) forced many users to look for passwords not stored in any place such as generated on demand passwords, dynamical passwords, stateless passwords, etc.
These passwords are not stored in any place, therefore they can not be hacked, stolen, damaged, confiscated, broken, etc.
The only way a hacker can get these passwords is to intercept them and break SSL encryption. This is a very hard task, but it can be done. In this post we consider how to create unhackable passwords for this type of situation. In fact, a solution to a problem of how to create secure passwords from two (or more unreliable or untrusted sources) is well known. We demonstrate it with two dynamical passwords generators (DPGs): public and private.
The first step is to generate passwords with a public DPG (for example https://dynpass.online ).
The second step is to generate passwords with a private DPG.
On the third step we select the first 10 symbols from the second password generated by the first DPG and the last 10 symbols from the 99-th password generated by the second DPG and combine the selected symbols to form a new password. (You can use your own rules for creations of unhackable passwords.)
I(m(IZ!M!h@vAU=Rb_DG
This password is unhackable (even by quantum computers), because only a user knows the procedure of the password’s creation.
The number of possible combinations is over 1.7* 10^13800, therefore it is not possible to find a particular combination in a reasonable time period by testing all possible combinations, even by using quantum computers.
ATTENTION!!!
For better security and convenience it is strongly recommended to use several private DPGs for generation of unhackable passwords.
References
[1] Bitwarden password vaults targeted in Google ads phishing attack
[2] PayPal hack
[3] Norton's Lifelock hack
[4] LastPass hack
[5] Multiple hacks
[6] 2.2 million passwords dumped online
[7] Researchers find 26 security flaws in 9 popular android password managers
[8] Other hacks
