tag:help.masterpassword.app,2014-09-03:/help/discussions/questions/357-what-happens-when-i-need-to-change-my-password-eg-on-a-websiteMaster Password: Discussion 2019-06-19T18:06:48Ztag:help.masterpassword.app,2014-09-03:Comment/458819742018-08-13T15:54:44Z2018-08-13T15:54:44ZWhat happens when I need to change my password (e.g. on a website)?<div><p>This is where the "counter" comes in. Every site has a counter value, which starts at 1 and can be incremented by you. You don't need to include this number in your site name, just look for the counter toggle in your Master Password client and increment it to get a new password or rewind it back to 1 to get the original password.</p></div>Maarten Billemonttag:help.masterpassword.app,2014-09-03:Comment/458819742018-08-14T10:50:36Z2018-08-14T10:50:38ZWhat happens when I need to change my password (e.g. on a website)?<div><p>Thanks for that explanation.</p>
<p>But this brings another problem: When a user has, let's say, 20 internet accounts, he probably cannot remember which account is set to which counter value. It's hard to remember even with 5 accounts. It's also hard to remember every username, especially if the user has multiple accounts on the same website or uses different usernames accross diferent websites. So again, some sort of syncing the MasterPassword database or carrying it on a usb drive is required. Sure, if a user has only two accounts this would not be a problem. But hey, who owns only two accounts?</p>
<p>This, to me, defeats the whole concept behind the MasterPassword app. Because users have to carry the database with them at all times. If the user looses the database, he cannot login anymore, because he probably won't remember the counter value and maybe the exact spelling of the username. Also, if a hacker/thief gets access to the database and master password and can log into it, he can (re-)generate all the user's passwords. This is the same problem all traditional password managers have, too.</p>
<p>So after all this, where's really the difference to a traditional password manager with a regular username/password database?</p></div>Marcostag:help.masterpassword.app,2014-09-03:Comment/458819742018-08-14T13:34:20Z2018-08-14T13:34:20ZWhat happens when I need to change my password (e.g. on a website)?<div><p>The username can be generated just like the password, if you like. That obviates the need to store it in some database.</p>
<p>With regards to the counter, in theory you are correct but in practice this is an issue that can be overcome. Since Master Password remembers your counter value for you in the app, it really only becomes a problem when you lose your phone / computer and get a new one, or when you need to use a site on a different computer than the one you set the counter on.</p>
<p>When you get into this situation, it suffices to use the generated password to log in with the site. If the login fails, just up the counter one and try again. After a few tries, you'll find the correct counter value and log in. The app will remember it for you. This is a bit of hassle, but it really is a "recovery" procedure only. You don't do it on a daily basis, only when recovering your sites from nothing. And it means you don't need to remember the counter, therefore don't need to keep a database. You can do everything without syncing or storing databases of sites.</p>
<p>Also remember that a Master Password database is not an encrypted file. It is less risky for a Master Password database to fall into the hands of an attacker, because there are no secrets in it, with arguable exception to the key ID, but this is a sha256 of a 64-byte master key, which is beyond several times the age of the universe in time scales to try to crack.</p></div>Maarten Billemonttag:help.masterpassword.app,2014-09-03:Comment/458819742018-11-12T15:54:38Z2018-11-12T15:54:39ZWhat happens when I need to change my password (e.g. on a website)?<div><p>What if a site doesn't allow you to change your username (i.e. it uses an email address for the username)? Would that mean I now have to change my master password, thereby requiring me to change my credentials to every site I use with this app?</p></div>Georgetag:help.masterpassword.app,2014-09-03:Comment/458819742018-11-12T15:59:05Z2018-11-12T15:59:05ZWhat happens when I need to change my password (e.g. on a website)?<div><p>Hi George,</p>
<p>I'm not certain I fully understand. What is the issue exactly that makes you feel a master password change might be necessary?</p></div>Maarten Billemonttag:help.masterpassword.app,2014-09-03:Comment/458819742018-11-12T16:10:20Z2018-11-12T16:10:20ZWhat happens when I need to change my password (e.g. on a website)?<div><p>I believe it was a bit of confusion on my part, due to the OP's wording. I read this thread a few more times and it finally made sense. My apologies. But, very happy to see such rapid replies!</p></div>Georgetag:help.masterpassword.app,2014-09-03:Comment/458819742018-11-12T16:11:11Z2018-11-12T16:11:11ZWhat happens when I need to change my password (e.g. on a website)?<div><p>Glad it's cleared up!</p></div>Maarten Billemonttag:help.masterpassword.app,2014-09-03:Comment/458819742019-01-31T23:21:18Z2019-01-31T23:21:19ZWhat happens when I need to change my password (e.g. on a website)?<div><p>what about sites that require a password change on a regular basis AND only allow a limited number of login attempts before locking down the account? Incrementing the counter will only work if you can guess where the counter is currently set airly closely...you might only get three chances. Unless I'm missing something?</p></div>Stevetag:help.masterpassword.app,2014-09-03:Comment/458819742019-03-04T20:00:33Z2019-03-04T20:00:34ZWhat happens when I need to change my password (e.g. on a website)?<div><p>@Steve: I have an account that require a new password every month. So I set the counter like this: yymm, e. g. 1901 for January 2019, 1902 for February 2019 and so on. You can use the counter with your own system and for your needs. So it is not so hard to find the right password with one or two tries on a other or new device.</p></div>Mario