4 ms·

From the points above only #3 affect traditional password managers as well. PMs allows you to save multiple fields (including usernames), support any type of p

by m1keil 9y ago

From the points above only #3 affect traditional password managers as well. PMs allows you to save multiple fields (including usernames), support any type of password format you want (including configurable password generators) and when password change is needed (either for website or master password) you just need to change one password. Re #2: what I was referring to is that you might end up having different formatting functions for different sites (think about one that limits you to 8 characters for example - these still exists!!). Re #3: that's true that you have similar problem with password managers. The small difference is that I don't need to remember the exact characters. For the pinterest example, I just need to search for "pinterest" and not be bother with the ".fr" and my password manager will be smart enough to find "pinterest.fr". Obviously "pinterest" changed to "qwerty" I'll be in trouble. I know it's a small difference, but I feel like small things like this are "make or break" when it comes to ease of use. It is true you can start maintaining lists of "exceptions" (i.e special user names or counters). But that starts to be really inconvenient in my opinion. Maybe I'm just spoiled. ;)

ecesena 9y ago
I'm not sure I really follow your logic, and sorry in advance I don't mean to say you're wrong, I'm just trying to understand deeper. It seems that you're comparing a PM with a fully featured app, vs an early-stage idea that I'm proposing. I'm comparing 2 core algorithms, vault vs deterministic. Assume I will release an app very similar to 1password, but with "my" core algorithm. Or, if you prefer, assume you don't have your PM handy. But, I think, the comparison should be fair. What I'm trying to say is that all the features you're proposing can be implemented/applied to my core algo as well, they don't deal with how you generate a secret, but more on how do you manage many of them. On changing the password there's another case. If your master password for a group is leaked, and you fear that the vault is also exposed, then you have to change all the passwords in the group. If you think to "high mobility" uses, like using your PM also on untrusted/partially trusted devices, the exposure of the vault is not really something you can exclude. I believe that the core difference between vault and deterministic is this one. Vault, you have completely random passwords, you always need the PM to retrieve them. Deterministic, you can recover your passwords without the PM (some of them, if you remember the info) -- my algo attempts to really go full in that direction. Everything else is "management" features, that you can build on top of the core.

by m1keil 9y ago

ecesena 9y ago

I'm not sure I really follow your logic, and sorry in advance I don't mean to say you're wrong, I'm just trying to understand deeper. It seems that you're comparing a PM with a fully featured app, vs an early-stage idea that I'm proposing. I'm comparing 2 core algorithms, vault vs deterministic. Assume I will release an app very similar to 1password, but with "my" core algorithm. Or, if you prefer, assume you don't have your PM handy. But, I think, the comparison should be fair. What I'm trying to say is that all the features you're proposing can be implemented/applied to my core algo as well, they don't deal with how you generate a secret, but more on how do you manage many of them. On changing the password there's another case. If your master password for a group is leaked, and you fear that the vault is also exposed, then you have to change all the passwords in the group. If you think to "high mobility" uses, like using your PM also on untrusted/partially trusted devices, the exposure of the vault is not really something you can exclude. I believe that the core difference between vault and deterministic is this one. Vault, you have completely random passwords, you always need the PM to retrieve them. Deterministic, you can recover your passwords without the PM (some of them, if you remember the info) -- my algo attempts to really go full in that direction. Everything else is "management" features, that you can build on top of the core.