Ah, another one for my list, and this one from a big vendor like Cloudflare! On my to-do list is a little project that takes many password "managers" like thes

Ah, another one for my list, and this one from a big vendor like Cloudflare! On my to-do list is a little project that takes many password "managers" like these, which are really just hash functions with an interface (called "vaultless" here), takes as second input a dump of password hashes that nobody has cracked yet, and goes to down the hashes list trying the usual password list but running it through these "managers"' algorithms first. I wonder how many people turn out to use weak passwords as their master key for this sort of thing. Maybe this is more clear: foreach linkedin_hashlist as hash do foreach brainpwdmgr_algorithms as algo do foreach wordlist as word do c = algo(pwd=word, site='linkedin.com') if c == hash then print(c, word) fi end end end If the --password input for these tools is guessable, an attacker can use this to retrieve the key that this tool will generate for any website. I can then go on and try likely usernames (I've already got one, presumably) on various sites with what I know is probably the correct password. A handful of failed logins per website don't attract attention, and I'm already virtually certain of the login credentials. This "gokey" does have the option to add a seed file, which would make such an attack impossible if generated securely. How many people use that option is the question. In the readme the seed-file-less mode is labeled as the "simple mode", perhaps that sounds attractive to some readers that don't realize the danger of the simple mode (kind of sounds like "default mode", when you don't want fancy options, just a standard password vault?). (If someone wants to steal this idea, feel free to pick it up of course; the actual work is in the execution as always.)