4 ms·

Could someone detail the process of "sharing a masked password", or at least how it would theoretically be implemented as a feature? I'm not quite sure I get th

Could someone detail the process of "sharing a masked password", or at least how it would theoretically be implemented as a feature? I'm not quite sure I get the scenario. Is the masked password to access passpack user account? Or is it to access some site passpack is managing a password for?

code_duck 15y ago
It seems to be some sort of utter nonsense imagined by someone who has no idea how any of this works. Well written article, but I don't see why it's worth taking the time to address this.
- seabee 15y ago
  You overestimate people's understanding of security. Clearly Passpack have had enough customers request the feature or complain about its absence to be worth writing about it.
  - code_duck 15y ago
    The customers don't care about the particular method, they just know what they want to accomplish and try to suggest how they think it may work. It's beside the point and somewhat obtuse to go into detail explaining why a particular way doesn't work. A much better way to respond to this request would be 'Yes! Here's a one time/time limited password generator that will do what you want'.
    - mc32 15y ago
      passpack already provides the ability to generate one-time passwords.
      - code_duck 15y ago
        Great, what I'm saying is they should steer their customers towards the solution and not bother refuting inanity.
amalcon 15y ago
I think what they want to do is temporarily grant someone else the ability to authenticate using their passpack account, without actually exposing the passwords. This is, of course, not possible in the general case. You can (sort of) do it for a specific site by changing the password and changing it back when you're done, which is what I ask people to do whenever they want me to poke around in their accounts. That obviously doesn't generalize across sites.
- personalcompute 15y ago
  It is 100% possible actually. They are called temporary generated one-use passwords.
  - amalcon 15y ago
    That is a feature that must be implemented by the service in question; it's impossible for a password manager to do it in the general case.

code_duck 15y ago

It seems to be some sort of utter nonsense imagined by someone who has no idea how any of this works. Well written article, but I don't see why it's worth taking the time to address this.

seabee 15y ago
You overestimate people's understanding of security. Clearly Passpack have had enough customers request the feature or complain about its absence to be worth writing about it.
- code_duck 15y ago
  The customers don't care about the particular method, they just know what they want to accomplish and try to suggest how they think it may work. It's beside the point and somewhat obtuse to go into detail explaining why a particular way doesn't work. A much better way to respond to this request would be 'Yes! Here's a one time/time limited password generator that will do what you want'.
  - mc32 15y ago
    passpack already provides the ability to generate one-time passwords.
    - code_duck 15y ago
      Great, what I'm saying is they should steer their customers towards the solution and not bother refuting inanity.

amalcon 15y ago

I think what they want to do is temporarily grant someone else the ability to authenticate using their passpack account, without actually exposing the passwords. This is, of course, not possible in the general case. You can (sort of) do it for a specific site by changing the password and changing it back when you're done, which is what I ask people to do whenever they want me to poke around in their accounts. That obviously doesn't generalize across sites.

personalcompute 15y ago
It is 100% possible actually. They are called temporary generated one-use passwords.
- amalcon 15y ago
  That is a feature that must be implemented by the service in question; it's impossible for a password manager to do it in the general case.