4 ms·
A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (mas
by bruce343434 3y ago
A password manager relies on a single point of failure secret (master password), while the website-hash approach relies on a single point of failure secret (master key derivation algorithm).
It's really no different, so I think there must be some human biased thinking at play. Except the password manager requires a central or synchronizing computer system, while the in-head key derivation approach requires no such thing.
The trade off is that pass mgnrs give more convenience, but have slightly more failure modes (not knowing the master password, not having access to the synchronization or master vault, not wanting to log into a pass mngr on a potentially compromised computer when you only need a single password you are willing to sacrifice) while the in-head approach has a single one: not remembering the derivation method.
ETA: both are sensitive to sites changing names or URLs. But password managers more so (requiring extra searching and clicks) while in a mental key derivation context, you would probably remember "oh, it's protonmail." without explicitly needing to distinguish "login.proton.me" from their old URL. But, that does make the key derivation approach slightly more susceptible to phishing. Not seeing the password autofill at least gives mental pause.
- paulmd 3y agoYour mental password-generation scheme is equally susceptible to the “master password” being lost or forgotten. Why do you assume you can remember a bunch of rules plus a password, if you can’t remember the password itself? Synchronizing is easy, put it in a network share or Dropbox/google drive/iCloud. If for some reason it’s inaccessible, keepass/dropbox will synchronize any local changes the next time you open the manager while you’re at home. This is a solved problem.
- deleted 3y ago[deleted]
- hobs 3y agoYou missed a few glaring failure modes in the mental model one - one of the most extreme is if someone pops your password on two sites, they can likely derive all your other passwords.
- throw310822 3y agoSure, although I wonder how often anyone is actually looking at single passwords, rather than just pushing tons of them through automated systems.
- evilduck 3y agoDepends on your threat model. Public figures likely have their passwords individually scrutinized when their accounts are found out.
- paulryanrogers 3y agoI'd go further and point out that derived secret systems put all your future passwords at risk. Whereas a password manager is only your current and past passwords.
- para_parolu 3y agoHash method is prone to websites that rotates passwords, have limits in passwords, have certain rules known passwords. Also, if website database is breached then you may want to create a different password. Plus, username needs to be stored as well sometimes.