4 ms·
It is an improvement, for sure. And probably good enough for the average user. On the other hand, if convenience is important, then I see no obvious difference
by bsza 7y ago
It is an improvement, for sure. And probably good enough for the average user.
On the other hand, if convenience is important, then I see no obvious difference between an online password manager and the OP's solution. In both cases, the security of your password vault depends directly on the security of your master password.
- soraminazuki 7y agoI don't think that assumption is true because it should be far more easier to brute force the master password of a deterministic password manager. Worse, the OP's solution accepts "password" as a master password, which means that many, many people are going to have the same generated passwords if this gets widely adopted.
- bsza 7y agoThat's... not reassuring. Though I would still argue that that is more of an implementation issue, not a deal-breaker for the general idea. And there are many KDF variants that (claim to) offer protection against brute force, so that's not necessarily an issue either (but I do agree it sounds risky).