4 ms·
They're still different, the two schemes. In the case of a traditional password manager, an attacker would need to get your master password and the password dat
by domador 9y ago
They're still different, the two schemes.
In the case of a traditional password manager, an attacker would need to get your master password and the password datastore. In the case of datastores stored locally, rather than online, that's still two separate steps.
In the case of your idea, once an attacker knows the seed, they have everything. Furthermore, if there's some weakness in the algorithm you use to generate passwords from the seed, then some site which has one of your deterministically-generated passwords could potentially breach the weak algorithm to reverse the process and obtain your seed, along with all your other passwords.
Lastly, with a traditional password manager, you can change the master password at any time. Would you be able to change your seed when needed, or would you need to regenerate your passwords for EVERY site, if you need change the seed because it's been compromised?