Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Forgiva – Never saves your passwords but regenerates them

forgiva.com

Post reply on HN
Print view View original

21–30 of 98 posts

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#21

Post by marcusfrex »

blowski wrote: post #12

As an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when I need them I'm currently really happy with 1Password on both counts, and I don't really understand why I should move. A competitor would need to establish that they are at least as secure as 1Password, and this landing page doesn't do that…

Theoretically stored passwords are not safe at all. Sooner or later they will get stolen if it is the case.

Forgiva is actually big brother of kyle (https://github.com/esurharun/kyle) which has been at use for nearly 2 years and experienced and tested a lot.

Yes, you are definitely right on that we should put roadmap on webpage.

And no we are nor "nefarious" hackers neither junior NodeJS developers. :)

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#24

Post by cauterized »

buro9 wrote: post #8
SNvD7vEJ wrote: post #3

How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.) Fixes poor passwords, accessibility and storage problems with highly secure way. What does that even mean?

The way I read it... it's a password manager that doesn't store passwords (centrally or locally). Instead it regenerates the password each time. i.e. password for HN may be: some trait of HN (domain?) + some salt + your identity (cert?) to always produce the same password. I didn't understand it all from the site, the explanations and broken English didn't really elucidate. But... if my understanding was right, I won…

What happens then if you want/need to rotate your password?

How does it deal with stupid password format restrictions?

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#25

Post by microtonal »

marcusfrex wrote: post #21
blowski wrote: post #12

As an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when I need them I'm currently really happy with 1Password on both counts, and I don't really understand why I should move. A competitor would need to establish that they are at least as secure as 1Password, and this landing page doesn't do that…

Theoretically stored passwords are not safe at all. Sooner or later they will get stolen if it is the case. Forgiva is actually big brother of kyle ( https://github.com/esurharun/kyle ) which has been at use for nearly 2 years and experienced and tested a lot. Yes, you are definitely right on that we should put roadmap on webpage. And no we are nor "nefarious" hackers neither junior NodeJS developers. :)

Theoretically stored passwords are not safe at all.

What does this even mean? Aren't they as safe as the cryptography being used (key derivation scheme, encryption method, etc.)?

(Of course, if a machine is compromised with a keylogger, it's pretty much game over anyway. Unless you use a hardware authentication token.)

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#26

Post by icebraining »

marcusfrex wrote: post #13
dsego wrote: post #10

I use getvau.lt, how does this compare?

Same strategy but Forgiva doesn't just use one key derivation algorithm (such as PBKDF2) but plus various hashing and encryption algorithms too. And at the same time you may forget the options you used in Vault, it is not an option in Forgiva.

plus various hashing and encryption algorithms too.

Is there any evidence that using multiple algorithms has any benefit over simply increasing the cost factor on one?

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#27

Post by marcusfrex »

microtonal wrote: post #25
marcusfrex wrote: post #21

Earlier quoted context omitted.

Theoretically stored passwords are not safe at all. Sooner or later they will get stolen if it is the case. Forgiva is actually big brother of kyle ( https://github.com/esurharun/kyle ) which has been at use for nearly 2 years and experienced and tested a lot. Yes, you are definitely right on that we should put roadmap on webpage. And no we are nor "nefarious" hackers neither junior NodeJS developers. :)

Theoretically stored passwords are not safe at all. What does this even mean? Aren't they as safe as the cryptography being used (key derivation scheme, encryption method, etc.)? (Of course, if a machine is compromised with a keylogger, it's pretty much game over anyway. Unless you use a hardware authentication token.)

>> What does this even mean?

Again "theoretically" all encryption methods prone to brute-force attacks. And plus, encrypted storages indirectly reveals "encryption passwords" on succeeded attacks.

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#28

Post by kevhito »

marcusfrex wrote: post #27
microtonal wrote: post #25

Earlier quoted context omitted.

Theoretically stored passwords are not safe at all. What does this even mean? Aren't they as safe as the cryptography being used (key derivation scheme, encryption method, etc.)? (Of course, if a machine is compromised with a keylogger, it's pretty much game over anyway. Unless you use a hardware authentication token.)

>> What does this even mean? Again "theoretically" all encryption methods prone to brute-force attacks. And plus, encrypted storages indirectly reveals "encryption passwords" on succeeded attacks.

And if you go that path, "theoretically" an attacker might simply guess your password on the first try when attempting to log in as you, so password "storages" and "brute-force" has nothing to do it.

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#29

Post by arthurfm »

> To crack a password with 70 bit entropy on a MacBook Pro Early 2013 it will take ~6 million years to complete all combinations on Normal complexity. On Intermediate complexity it will take ~24 million years and on Advanced complexity it will take ~280 million years to reach all combinations at minimum.

If you were cracking a password wouldn't it be significantly faster to use GPU(s) rather than CPUs [1]? If so, why bother mentioning how long it would take on a CPU at all?

[1] http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...

Re: Show HN: Forgiva – Never saves your passwords but regenerates them

#30

Post by ninov »

I wrote something similar some time ago: https://addons.mozilla.org/de/firefox/addon/masterkey/ https://github.com/ninov/masterkey-firefox

Or as android app: https://play.google.com/store/apps/details?id=de.ninov.maste...

It works by using SHA256-HMAC on the service name with your master key as key and then encoding it in Base85 or Base62 (if you don't want special characters)

Post reply on HN