3 ms·
Standard issues with these derived password schemes: * Are you sure your algorithm can't be reversed? * What do you do if your normal username is taken? * Wh
by ben509 7y ago
Standard issues with these derived password schemes:
* Are you sure your algorithm can't be reversed?
* What do you do if your normal username is taken?
* What do you do when the site's name changes?
* How do you handle forbidden and mandatory characters?
* How do you handle forced rotation?
* What about extraneous crap like security questions, phone PINs, emails, related sites, &c.?
* How do you access it on other devices?
* How can you track down old accounts to close them down?
If you go on listing the issues, you wind up writing the requirements document for a password manager.
- tzs 7y ago> If you go on listing the issues, you wind up writing the requirements document for a password manager. One difference, though, is that most of the issues can be addressed by some sort of persistent data store that does not need high security. Once you've taken the passwords themselves out of what your password manager stores, I think this is the only thing on your list that requires storing highly sensitive data: > What about extraneous crap like security questions, phone PINs, emails, related sites, &c.? For the rest, such as some sort of per site version serial number to handle password rotation, or a map from current site name to original site name for sites whose names have changed, it is also sensitive data, but it is on a level of sensitivity like a contact list or browser bookmarks for which your ordinary OS security mechanisms for file protection should be sufficient.
- _o-O-o_ 7y agohttps://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...