4 ms·
It doesn't even specify how many rounds of KDF are used in the readme. I really hope it's more than the default 4096. For reference, using KeepassXC, there's a
by deletemeplz 4y ago
It doesn't even specify how many rounds of KDF are used in the readme. I really hope it's more than the default 4096. For reference, using KeepassXC, there's a "benchmark" button that finds the number of rounds for a 1 second delay and the number of rounds for my computer is in the 50000000 range.
It just takes one compromised password to start a dictionary based or other offline attack to brute force the master password which would then allow the attacker to regenerate other realms.
- nprateem 4y agoIt even doesn't matter. Passwords should be regularly rotated and encouraging people to use this opens them up to bad practices since no one's going to rotate all their passwords at once, so they'll never do it.
- mhluongo 4y ago> Passwords should be regularly rotated Disagree. I'd even call required rotation a smell. Requiring rotation leads to people coming up with passwords more frequently, meaning they'll likely choose weaker passwords. On top of that, regular rotation isn't necessary for passwords generated independently by a password manager. The issue here is that there's no way to deal with revocation / password changes if a service is compromised.
- nprateem 4y agoIt doesn't matter what you think. If someone's using a service that requires it and the tool doesn't allow it it's no good.
- mhluongo 4y agoI responded to that in the original comment. Whether or not a service requires rotation (bad practice), this tool won't work (can't handle compromised passwords).
- jwilk 4y agoIt's 4096 iterations: https://github.com/cloudflare/gokey/blob/v0.1.0/csprng.go#L27 https://github.com/cloudflare/gokey/blob/v0.1.0/csprng.go#L2...