4 ms·
"we've built the entire internet and banking systems around it" Yes, but in those scenarios we use keys that are truly random. Deriving a symmetric key from a
by bsza 7y ago
"we've built the entire internet and banking systems around it"
Yes, but in those scenarios we use keys that are truly random. Deriving a symmetric key from a password and encrypting another password with it is simply never going to be as secure. You're better off storing it locally.
- soraminazuki 7y agoIn fact, some password managers (well, at least 1Password) do generate a random secret key that you're required to provide at login in addition to your master password.
- bsza 7y agoAt which point, I guess, the key has to be either short enough that you can remember it, or stored on a portable device.
- soraminazuki 7y agoYou need an already logged-in device or a printout of the secret key to login. The former isn't much of a concern because if an attacker has access to a logged-in device, you're screwed anyways. The latter would require physical access to your home, and the same applies here too.