4 ms·

A very easy scheme could be: password = hmac(url++nonce, master_key) You then store url and nonce. it's no problem that this info is public as far as I kn

A very easy scheme could be: password = hmac(url++nonce, master_key) You then store url and nonce. it's no problem that this info is public as far as I know, but perhaps you could again encrypt both the URL and the Nonce using symmetric encryption using the master key Every time you need to change your password, (because it leaked), you simply generate a new nonce. You only store the nonce and the URL and this seems like a very secure scheme to me. Cons: You can not change the master key after the fact, so make sure it's secure. I'm not a cryptographer, so I'm probably missing something obvious Edit: We still need to solve the "password constraints" problem. I would say, we could add functions that given the password stored, deterministically creates a string from the password that adheres to some specific password scheme. For example, by using the password as a seed to a random number generator used to fuel traditional password generators like the one included in lastpass. The 'scheme' would also be stored next to the nonce and the url.

simias 9y ago
I tried doing that a few years ago, random password constraints made it highly impractical. And if you end up using a database for storing your nonces and hashing schemes you'll end up with the same limitations and attack vectors the parent was complaining about.
- arianvanp 9y ago
  nonces and hashing schemes are not very sensitive information though. The nonce does not make the HMAC more predictible in any way
  - simias 9y ago
    A well encrypted password store isn't more sensitive though. That's the whole concept behind services like lastpass that host an encrypted blob in the "cloud". You could argue that it makes offline attacks easier because many encrypted storage formats have a way to check if the decryption was successful or not but you could remove this feature if that was a problem for you. And at any rate using a strong enough passphrase would make this attack impractical in the first place. And being notified when you used a wrong passphrase is pretty useful IMO.
- andai 9y ago
  Hmm, sounds like you need a deterministic password weakener!
theodorejb 9y ago
Isn't this basically what LessPass (https://lesspass.com/ https://lesspass.com/) does?

simias 9y ago

I tried doing that a few years ago, random password constraints made it highly impractical. And if you end up using a database for storing your nonces and hashing schemes you'll end up with the same limitations and attack vectors the parent was complaining about.

arianvanp 9y ago
nonces and hashing schemes are not very sensitive information though. The nonce does not make the HMAC more predictible in any way
- simias 9y ago
  A well encrypted password store isn't more sensitive though. That's the whole concept behind services like lastpass that host an encrypted blob in the "cloud". You could argue that it makes offline attacks easier because many encrypted storage formats have a way to check if the decryption was successful or not but you could remove this feature if that was a problem for you. And at any rate using a strong enough passphrase would make this attack impractical in the first place. And being notified when you used a wrong passphrase is pretty useful IMO.
andai 9y ago
Hmm, sounds like you need a deterministic password weakener!

theodorejb 9y ago

Isn't this basically what LessPass (https://lesspass.com/ https://lesspass.com/) does?