3 ms·

https://filepush.co/ZBdm/20200314_230353-maim.png https://filepush.co/ZBdm/20200314_230353-maim.png Masterpassword gives me a huge variety of different types o

https://filepush.co/ZBdm/20200314_230353-maim.png https://filepush.co/ZBdm/20200314_230353-maim.png Masterpassword gives me a huge variety of different types of passwords of minimal to high strength. Hell it even let's you use a personal password or key, which is something I learned just now. Say I only used the most powerful password type and have a very strong master password with 7+ words generated with diceware, do you think it's still fake security? Genuinely would like to know.

dagenix 7y ago
In a stateless system, you have to remember which options you picked. The more options there are to pick, the harder it is to remember them. I would suspect, that in general, most people pick from fairly limited number of options regardless of how many are actually available. The key point is that the options function effectively like a salt in a traditional password hashing scheme. And while a salt is generally a 32 or 64 bit value, there are almost certainly not nearly as many combinations of options that you would realistically pick from - unless you can remember a number between 0 and ~1.84e19 for each site that you login to. A stateless password manager means that any password compromise on any site that you have a password for allows an attacker to mount an offline attack against _every_ other website that you have a password for. If your master password is truly uncrackable, you'll be safe. But you'll only be safe if an attacker decides to give up after a few billion guesses. Some passwords are that secure. I'm not aware of any evidence that most people's passwords are, however. If you really have enough confidence in your master password that you don't have an issue with an attacker being able to mount an offline brute force attack against it, go for it. But in general, I think it's a very bad strategy for the vast, vast majority of people.
TheDong 7y ago
> Is it fake security Compared to what? Compared to a regular stateful password manager? Absolutely, for all the reasons mentioned by the parent poster. Stateful password managers are just more secure since the sitepasswords have no relationship between each other, so individual sites leaking a site password does not give them any possible attack. Compared to using just the master password for all sites? Well, a stateless password manager is probably better than that at least.

dagenix 7y ago

In a stateless system, you have to remember which options you picked. The more options there are to pick, the harder it is to remember them. I would suspect, that in general, most people pick from fairly limited number of options regardless of how many are actually available. The key point is that the options function effectively like a salt in a traditional password hashing scheme. And while a salt is generally a 32 or 64 bit value, there are almost certainly not nearly as many combinations of options that you would realistically pick from - unless you can remember a number between 0 and ~1.84e19 for each site that you login to. A stateless password manager means that any password compromise on any site that you have a password for allows an attacker to mount an offline attack against _every_ other website that you have a password for. If your master password is truly uncrackable, you'll be safe. But you'll only be safe if an attacker decides to give up after a few billion guesses. Some passwords are that secure. I'm not aware of any evidence that most people's passwords are, however. If you really have enough confidence in your master password that you don't have an issue with an attacker being able to mount an offline brute force attack against it, go for it. But in general, I think it's a very bad strategy for the vast, vast majority of people.

TheDong 7y ago

> Is it fake security Compared to what? Compared to a regular stateful password manager? Absolutely, for all the reasons mentioned by the parent poster. Stateful password managers are just more secure since the sitepasswords have no relationship between each other, so individual sites leaking a site password does not give them any possible attack. Compared to using just the master password for all sites? Well, a stateless password manager is probably better than that at least.