5 ms·
I think you're assuming that the algorithm must be reversible, but I don't see why. For example, hash(site|strong_master_password) isn't reversible under reason
by ecesena 9y ago
I think you're assuming that the algorithm must be reversible, but I don't see why. For example, hash(site|strong_master_password) isn't reversible under reasonable assumptions.
If the algorithm is not reversible, "one password is compromised, they all are" isn't true. Only if the master password is compromised, then all your passwords are (but this is exactly the same with any password manager.)
The one thing that personally I don't like about vaults is availability of my passwords. You need your password manager (i.e. the app) to get your passwords. I've had multiple situations, typically when traveling, where I didn't have access to my devices, and thus I didn't have the app.
- soccerdave 9y agoIn your scenario, what happens if you need to change strong_master_password? I’m assuming you now need to change every password on every single site or else remember your new strong password and your old.
- ecesena 9y agoIf you have to change your master password, you have to change all passwords. With a vault, if you ever “leaked” your vault file, it’s the same. To me, it’s hard to think to a realistic case where your master password is leaked, but you’re 100% sure your vault file is not.