4 ms·

Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master pa

by croon 10y ago

Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master password can't be changed without changing all your passwords. * You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were). With that said, I really like the outside-of-the-box thinking on this.

lemoniidae 10y ago
I have written a similar Password manager as an UWP for Windows [0]. It didn't get much attention since i never tried to get some. I could not agree more with the points you mentioned. To solve the last one I added the option to create an encrypted list for the sites. But so you end with an additional password you need to remember because using the same as for the masterkey makes this the only key to access every password. And this is what the system tries to avoid. [0] https://github.com/AndHell/CreatePass https://github.com/AndHell/CreatePass
joosters 10y ago
Also, some sites (generally banks) change their login URLs and domains from time to time. With a 'traditional' password manager, I can map it to the old login details with a few clicks. With a stateless system, you're out of luck.
- croon 10y ago
  Very good point!
- Ajedi32 10y ago
  Also, some sites use a unified login which is shared between multiple sites owned by the same company. For example, StackOverflow uses an account which is shared across all the various StackExchange-type sites, and Gamepedia requires you to sign in with your "Curse Community Account". (I'm sure there are more examples; those are just the ones off the top of my head.)
- 5xman 10y ago
  Well, you are not forced to use a specificic url or your real login details to generate the password. You could do it with "My Personal Bank Account"+"My alias (not the same as my login)"+MASTER_PASSWORD. It's the same with SSO. You can use "Google Private" or "Google Public" and any login you want to generate a password for your google accounts, without using a real URL nor your real credentials.
irq-1 10y ago
Also, most people need help sooner or later, and they can't call IT for help with a system like this. Either they remember all the needed information or they don't. As a work flow nit-pick, what if the password requirements change? You need to remember the original settings to generate your password, but if the site now says "must include numbers" when it didn't before...
z3t4 10y ago
It's important to change your passwords at regular intervals, even if you use a secure one. If you compare this to two factor authentication it's the same amount of extra work, but without the benefits. You should also avoid copying passwords to the clipboard as many applications and even web sites might have access to it. Too bad client certifications are deprecated, now when SSL/TSL is becoming more and more popular. Only downside with client certificates is that you have to copy the key (witch can be password protected) to all your devices. Another downside was that the site required SSL/TSL, but almost every site have that now!
- Ajedi32 10y ago
  There's also some privacy and UX concerns with client certs. See http://www.browserauth.net/tls-client-authentication http://www.browserauth.net/tls-client-authentication Personally I'd love to see UAF or SQRL take off. Lots of potential there.
  - z3t4 10y ago
    most browsers will auto select the right cert. But for browsers that dont support the keygen tag you have to create the cert including priv key and pw. you can of course create many certs for different users, you can of course also sign them yourself, no ca is needed besides for the ssl server cert. most of the points on that site is moot besides poor support on some browsers.
palant 10y ago
For reference, I am the author of Easy Passwords extension which uses a very similar concept. These issues are definitely solvable, at least if you use a hybrid concept: while most passwords are generated, some can be encrypted and stored (encryption key derived from the master password). Easy Passwords has this functionality and LessPass appears to be working on it as well. Then changing algorithm or master password can be done by converting all existing generated passwords into stored password. This isn't a great solution of course and so far I haven't seen the need to implement this escape hatch but it can be done if absolutely necessary. As to remembering the websites where you registered - that should definitely be the job of the extension (not storing passwords doesn't mean that you cannot store metadata). And many password generators support a revision counter for passwords, you increase it when you need a new password.

by croon 10y ago

lemoniidae 10y ago

I have written a similar Password manager as an UWP for Windows [0]. It didn't get much attention since i never tried to get some. I could not agree more with the points you mentioned. To solve the last one I added the option to create an encrypted list for the sites. But so you end with an additional password you need to remember because using the same as for the masterkey makes this the only key to access every password. And this is what the system tries to avoid. [0] https://github.com/AndHell/CreatePass https://github.com/AndHell/CreatePass

joosters 10y ago

Also, some sites (generally banks) change their login URLs and domains from time to time. With a 'traditional' password manager, I can map it to the old login details with a few clicks. With a stateless system, you're out of luck.

croon 10y ago
Very good point!
Ajedi32 10y ago
Also, some sites use a unified login which is shared between multiple sites owned by the same company. For example, StackOverflow uses an account which is shared across all the various StackExchange-type sites, and Gamepedia requires you to sign in with your "Curse Community Account". (I'm sure there are more examples; those are just the ones off the top of my head.)
5xman 10y ago
Well, you are not forced to use a specificic url or your real login details to generate the password. You could do it with "My Personal Bank Account"+"My alias (not the same as my login)"+MASTER_PASSWORD. It's the same with SSO. You can use "Google Private" or "Google Public" and any login you want to generate a password for your google accounts, without using a real URL nor your real credentials.

irq-1 10y ago

Also, most people need help sooner or later, and they can't call IT for help with a system like this. Either they remember all the needed information or they don't. As a work flow nit-pick, what if the password requirements change? You need to remember the original settings to generate your password, but if the site now says "must include numbers" when it didn't before...

z3t4 10y ago

It's important to change your passwords at regular intervals, even if you use a secure one. If you compare this to two factor authentication it's the same amount of extra work, but without the benefits. You should also avoid copying passwords to the clipboard as many applications and even web sites might have access to it. Too bad client certifications are deprecated, now when SSL/TSL is becoming more and more popular. Only downside with client certificates is that you have to copy the key (witch can be password protected) to all your devices. Another downside was that the site required SSL/TSL, but almost every site have that now!

Ajedi32 10y ago
There's also some privacy and UX concerns with client certs. See http://www.browserauth.net/tls-client-authentication http://www.browserauth.net/tls-client-authentication Personally I'd love to see UAF or SQRL take off. Lots of potential there.
- z3t4 10y ago
  most browsers will auto select the right cert. But for browsers that dont support the keygen tag you have to create the cert including priv key and pw. you can of course create many certs for different users, you can of course also sign them yourself, no ca is needed besides for the ssl server cert. most of the points on that site is moot besides poor support on some browsers.

palant 10y ago

For reference, I am the author of Easy Passwords extension which uses a very similar concept. These issues are definitely solvable, at least if you use a hybrid concept: while most passwords are generated, some can be encrypted and stored (encryption key derived from the master password). Easy Passwords has this functionality and LessPass appears to be working on it as well. Then changing algorithm or master password can be done by converting all existing generated passwords into stored password. This isn't a great solution of course and so far I haven't seen the need to implement this escape hatch but it can be done if absolutely necessary. As to remembering the websites where you registered - that should definitely be the job of the extension (not storing passwords doesn't mean that you cannot store metadata). And many password generators support a revision counter for passwords, you increase it when you need a new password.