4 ms·
This sounds really cool, now why wouldn't the general population do it this way, even assuming it was packaged in a convenient open source app?
by hayksaakian 10y ago
This sounds really cool, now why wouldn't the general population do it this way, even assuming it was packaged in a convenient open source app?
- FabHK 10y agoThere are apps that do this, the magical password generator that doesn't need to sync anything. However, this well known method has many flaws: * very hard to satisfy all site-specific password requirements (need symbols, no symbols, at least 8 characters, at most 8 characters, etc. etc.) You can work around this by storing site-specific requirements, but then you need to sync again, basically. * very hard to version: if LinkedIn screws up again and you need to reset your LinkedIn password, but don't want to replace all your other passwords by changing the master password, what do you do? You can version by including a version number or so pre-hash, or increase the number of rounds (as the GP suggests) but then you need to sync the version number (or remember it or try), so you're back to square 1. * Also, might want to use Scrypt or Argon2 or so instead. There are other problems. See related HN discussions for these frequently suggested storage-less "password managers": https://news.ycombinator.com/item?id=12889807 https://news.ycombinator.com/item?id=12889807 https://news.ycombinator.com/item?id=11557662 https://news.ycombinator.com/item?id=11557662