3 ms·
It's a vast improvement over the traditional alternative of people reusing passwords across sites IMHO. It's hard enough to get non-technical people to use pass
by soraminazuki 7y ago
It's a vast improvement over the traditional alternative of people reusing passwords across sites IMHO. It's hard enough to get non-technical people to use passwords managers. The chance of getting people to use a password manager without a usable syncing capability is virtually none.
- bsza 7y agoIt is an improvement, for sure. And probably good enough for the average user. On the other hand, if convenience is important, then I see no obvious difference between an online password manager and the OP's solution. In both cases, the security of your password vault depends directly on the security of your master password.
- soraminazuki 7y agoI don't think that assumption is true because it should be far more easier to brute force the master password of a deterministic password manager. Worse, the OP's solution accepts "password" as a master password, which means that many, many people are going to have the same generated passwords if this gets widely adopted.
- bsza 7y agoThat's... not reassuring. Though I would still argue that that is more of an implementation issue, not a deal-breaker for the general idea. And there are many KDF variants that (claim to) offer protection against brute force, so that's not necessarily an issue either (but I do agree it sounds risky).