3 ms·

You could store a bit of metadata per password. Like an additional salt that you change every time you have to change the password, plus any requirements for ge

by Asooka 4y ago

You could store a bit of metadata per password. Like an additional salt that you change every time you have to change the password, plus any requirements for generating it. Of course then it is using a kind of a vault.

umvi 4y ago
Right but that metadata (like password rules) is pretty much public information so it doesn't matter if an attacker gets it so it doesn't have to be as secure as a "vault".
- resoluteteeth 4y ago
  Once you're assuming 1) you trust your master password or encryption key to provide sufficient security to generate passwords based on the domain and 2) you have a file you're synchronizing that contains metadata for each site like passwords changes and usernames well, guess what? Just go ahead and generate random passwords for each site, encrypt them with the master key, and store them in the metadata file! Since they're encrypted, the encrypted passwords are no longer more sensitive than the other metadata in the file and you just reinvented a normal password manager.
  - umvi 4y ago
    The biggest problem with password managers is that you become completely dependent on them (and therefore completely helpless without them) once you start using them. This scenario still allows you to remain decoupled from that dependency. You could print out a copy of your metadata to take with you on your trip to Europe without worrying that you'll be completely hosed if someone steals your phone/password manager.
    - usrbinbash 4y ago
      > You could print out a copy of your metadata to take with you on your trip to Europe without worrying that you'll be completely hosed if someone steals your phone/password manager. I can take a copy of my pwd vault with me. I'm using pass, so the vault is a directory of files encrypted with a private key, which itself is encrypted with a strong passphrase. Even if I do end up losing that copy; What are the chances that someone breaks todays encryption standards, and does so before I notice the loss and simply change all my passwords?
      - umvi 4y ago
        How do you get into your accounts if you are on vacation and you lose the copy of your pwd vault?

by Asooka 4y ago

umvi 4y ago

Right but that metadata (like password rules) is pretty much public information so it doesn't matter if an attacker gets it so it doesn't have to be as secure as a "vault".

resoluteteeth 4y ago
Once you're assuming 1) you trust your master password or encryption key to provide sufficient security to generate passwords based on the domain and 2) you have a file you're synchronizing that contains metadata for each site like passwords changes and usernames well, guess what? Just go ahead and generate random passwords for each site, encrypt them with the master key, and store them in the metadata file! Since they're encrypted, the encrypted passwords are no longer more sensitive than the other metadata in the file and you just reinvented a normal password manager.
- umvi 4y ago
  The biggest problem with password managers is that you become completely dependent on them (and therefore completely helpless without them) once you start using them. This scenario still allows you to remain decoupled from that dependency. You could print out a copy of your metadata to take with you on your trip to Europe without worrying that you'll be completely hosed if someone steals your phone/password manager.
  - usrbinbash 4y ago
    > You could print out a copy of your metadata to take with you on your trip to Europe without worrying that you'll be completely hosed if someone steals your phone/password manager. I can take a copy of my pwd vault with me. I'm using pass, so the vault is a directory of files encrypted with a private key, which itself is encrypted with a strong passphrase. Even if I do end up losing that copy; What are the chances that someone breaks todays encryption standards, and does so before I notice the loss and simply change all my passwords?
    - umvi 4y ago
      How do you get into your accounts if you are on vacation and you lose the copy of your pwd vault?