4 ms·

Don't want to be too negative but that's a hilariously bad idea. Basically the security of the scheme relies entirely on the strength of the master password. If

Don't want to be too negative but that's a hilariously bad idea. Basically the security of the scheme relies entirely on the strength of the master password. If a third party every discovers that password it can derive all your credentials (current and future ones) from that single password and the applicable URL (which often can be figured out easily). And if you use a seed file with this as suggested in the README you can as well use a regular encrypted database, which at least allows you to upgrade passwords.

paulryanrogers 4y ago
It's curious watching all these derived password solutions evolve. They all end up taking on state, or requiring laborious transitions, if either a derived or master secret is compromised. Then their sync-free guarantees fall away. SQRL went through all these things in slow motion. Or at least that's how it felt listening to the "Security Now" podcast.
- SloopJon 4y ago
  > They all end up taking on state Note that the recommended operation for GoKey requires the use of a seed file. Instead of deriving passwords directly from the master password, it derives them from a file of random data that is decrypted by the master password. While it's true that this seed file doesn't require the ongoing synchronization that a vault does, it's something that you need to have, and to manage with care.
  - djbusby 4y ago
    So...state with careful management of a secret? Double plus ungood.
  - laurent123456 4y ago
    > While it's true that this seed file doesn't require the ongoing synchronization that a vault does, it's something that you need to have, and to manage with care. But even if it rarely changes, how would that file be synced in practice? Probably dropped in a Syncthing or Nextcloud folder. And if you do that, you may as well drop a Keepass file in there, and not have to deal with the many problems that this "vaultless" solution cause.
jtwebman 4y ago
Is this not how crypto wallets work as well for at least most of them they come from seed phrases.
- mhluongo 4y ago
  New seed phrases are typically 12-24 randomly generated words, not user provided... and when you need to "change a password" in a crypto wallet, you can generate a new private key and move funds. Check out BIP-39 [0] for more details. [0] - https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi...

paulryanrogers 4y ago

It's curious watching all these derived password solutions evolve. They all end up taking on state, or requiring laborious transitions, if either a derived or master secret is compromised. Then their sync-free guarantees fall away. SQRL went through all these things in slow motion. Or at least that's how it felt listening to the "Security Now" podcast.

SloopJon 4y ago
> They all end up taking on state Note that the recommended operation for GoKey requires the use of a seed file. Instead of deriving passwords directly from the master password, it derives them from a file of random data that is decrypted by the master password. While it's true that this seed file doesn't require the ongoing synchronization that a vault does, it's something that you need to have, and to manage with care.
- djbusby 4y ago
  So...state with careful management of a secret? Double plus ungood.
- laurent123456 4y ago
  > While it's true that this seed file doesn't require the ongoing synchronization that a vault does, it's something that you need to have, and to manage with care. But even if it rarely changes, how would that file be synced in practice? Probably dropped in a Syncthing or Nextcloud folder. And if you do that, you may as well drop a Keepass file in there, and not have to deal with the many problems that this "vaultless" solution cause.

jtwebman 4y ago

Is this not how crypto wallets work as well for at least most of them they come from seed phrases.

mhluongo 4y ago
New seed phrases are typically 12-24 randomly generated words, not user provided... and when you need to "change a password" in a crypto wallet, you can generate a new private key and move funds. Check out BIP-39 [0] for more details. [0] - https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi...