This seems similar to Master Password (http://masterpasswordapp.com/).
Show HN: Forgiva – Never saves your passwords but regenerates them
31–40 of 98 posts
Re: Show HN: Forgiva – Never saves your passwords but regenerates them
#32Earlier quoted context omitted.
The way I read it... it's a password manager that doesn't store passwords (centrally or locally). Instead it regenerates the password each time. i.e. password for HN may be: some trait of HN (domain?) + some salt + your identity (cert?) to always produce the same password. I didn't understand it all from the site, the explanations and broken English didn't really elucidate. But... if my understanding was right, I won…
What happens then if you want/need to rotate your password? How does it deal with stupid password format restrictions?
the salt gets changed
so, either password database + master password gets stolen, or salt database + master password gets stolen
Re: Show HN: Forgiva – Never saves your passwords but regenerates them
#33Earlier quoted context omitted.
Same strategy but Forgiva doesn't just use one key derivation algorithm (such as PBKDF2) but plus various hashing and encryption algorithms too. And at the same time you may forget the options you used in Vault, it is not an option in Forgiva.
plus various hashing and encryption algorithms too. Is there any evidence that using multiple algorithms has any benefit over simply increasing the cost factor on one?
assuming combined correctly
A( B( C(X) ) ), if A becomes broken in the future, its still
B( C(X) ), as opposed to just revealing X straight away
Re: Show HN: Forgiva – Never saves your passwords but regenerates them
#34How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.) Fixes poor passwords, accessibility and storage problems with highly secure way. What does that even mean?
It looks like it isn't completely closed source, https://github.com/sceptive/Forgiva .
NC licenses aren't considered "Open Source":
Re: Show HN: Forgiva – Never saves your passwords but regenerates them
#35How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.) Fixes poor passwords, accessibility and storage problems with highly secure way. What does that even mean?
>> How does this compare, for example, to the KeePass family of pw-managers? It is a password manager too but with an alternative approach. >> "Fixes poor passwords, accessibility and storage problems with highly secure way." >> What does that even mean? Generates strong passwords by default, you can access them anywhere with it and does not need to store anywhere.
>you can access them anywhere with it and does not need to store anywhere
But you have to carry the database with you anyway and have to store somewhere. So what's the point of having database with everything but passwords?
And you still need the database encrypted, because you don't want to give the attacker your usernames, emails, recovery answers and other stuff, do you?
Re: Show HN: Forgiva – Never saves your passwords but regenerates them
#36This is similar to masterpassword . They have a mobile app and desktop app . Moreover they are completely free .
http://masterpasswordapp.com/
Re: Show HN: Forgiva – Never saves your passwords but regenerates them
#37Earlier quoted context omitted.
It looks like it isn't completely closed source, https://github.com/sceptive/Forgiva .
NC licenses aren't considered "Open Source": http://www.opensource.org/docs/osd
Interesting, but then what do you call something who's source is available to be viewed?
Re: Show HN: Forgiva – Never saves your passwords but regenerates them
#38As an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when I need them I'm currently really happy with 1Password on both counts, and I don't really understand why I should move. A competitor would need to establish that they are at least as secure as 1Password, and this landing page doesn't do that…
Theoretically stored passwords are not safe at all. Sooner or later they will get stolen if it is the case. Forgiva is actually big brother of kyle ( https://github.com/esurharun/kyle ) which has been at use for nearly 2 years and experienced and tested a lot. Yes, you are definitely right on that we should put roadmap on webpage. And no we are nor "nefarious" hackers neither junior NodeJS developers. :)
https://github.com/esurharun/kyle/blob/master/lib/kyle.rb#L1...
ret += Constants::PASSWORD_CHARS[c % Constants::PASSWORD_CHARS.length]
Also, what is this? (From https://github.com/sceptive/Forgiva)
algorithm forgiva-iterative-hashing
Input: Value to hashed as DATA, Algorithm array AARRAY
Ouput: Hashed input data
final_value = DATA
for each character C in DATA
algorithm = AARRAY index of (C code num modulus AARRAY)
final_value = forgiva-hash(final_value, algorithm)
return final_value
> It's developed by security professionals
Re: Show HN: Forgiva – Never saves your passwords but regenerates them
#39Your password will never be secure when you store it on someone else his disk or let someone else encrypt your password. Its not a matter of how, but when there will be a way to retreive those passwords by anything but you. And its not just that, everything you use your passwords for these days, is stored on some sort of storage in a cloudy architecture. Scattered all over the world in thousands of datacenters. You p…
What do you mean?
This solution does not store passwords at all, if I understand it correctly.
So whining about storing them on "someone else disk" is a bit odd, don't you think?