4 ms·
If your master password leaks you are exposed on every website where you used this scheme (and you should then change every password), so on the security side t
by hiq 9y ago
If your master password leaks you are exposed on every website where you used this scheme (and you should then change every password), so on the security side this is inferior to a master password granting access to uncorrelated passwords.
- amelius 9y agoWell, you can add a salt to this scheme. I know, it's not perfect, but it beats carrying around password files between devices.
- jbg_ 9y agoBut you would just need to carry the salt around instead. You're just trading convenience for (significantly) lower security.
- amelius 9y agoYes, it's a trade-off. By the way, I'd prefer to have a password manager on my phone (or smartwatch), and have it beam my password to my keyboard by NFC. But this solution does not exist yet.
- hiq 9y agoAs the other commenter pointed out, you need to carry your salt with you to deduce the actual password. On top of that, you need to keep your salt secret, otherwise it is trivial to deduce your password. So your system [password = hash(master password, salt, domain)] is exactly the same as a master password protecting several other ones. Just use your salt as a password directly at this point...