5 ms·
All such deterministic algorithms are seeded by something. This is their basic flaw. Guess the seed and you get all the passwords. With a password manager that
by patrickmn 9y ago
All such deterministic algorithms are seeded by something. This is their basic flaw. Guess the seed and you get all the passwords.
With a password manager that randomly generates unique passwords, you don't have that problem, but you do have to synchronize the data.
- w8rbt 9y agoThe master password of the password manager has the same issue plus the burden of storage.
- simondedalus 9y agoand the virtue of allowing a single point of 2FA. the seed is just the seed, and will always be the seed. the master password can change and be supplemented by 2FA / other enhancement schemes.
- w8rbt 9y agoI'm not sure we're talking about the same thing. See the code I posted. There is no unchangeable static seed.
- patrickmn 9y agoIt's not the same issue. With your approach, a compromise of the seed is catastrophic and reveals everything. With a regular password manager, you also need access to the vault encrypted using that master password. That's not a given -- most password managers either store their vaults locally or offer 2FA when synced. (Nevermind that you can't change individual passwords or the master password at will with a deterministic scheme.)