Horcrux: A Password Manager for Paranoids

Post by theodorejb » Mon, Jun 19, 2017, 3:07 PM UTC

arianvanp wrote: post #24

w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

A very easy scheme could be: password = hmac(url++nonce, master_key) You then store url and nonce. it's no problem that this info is public as far as I know, but perhaps you could again encrypt both the URL and the Nonce using symmetric encryption using the master key Every time you need to change your password, (because it leaked), you simply generate a new nonce. You only store the nonce and the URL and this seems…

Post by andrepd » Mon, Jun 19, 2017, 3:10 PM UTC

brbz wrote: post #23

w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

How could you generate passwords that satisfy arbitrary password constraints? Say example.com has a 20 character limit, must contain a capital letter and symbol (but not certain symbols), and can't contain a dictionary word. It seems to me like your generator would have to have an option for each constraint to satisfy, and you'd have to remember them at the time of retrieval (unless you store the settings). Is there…

Post by AdmiralAsshat » Mon, Jun 19, 2017, 3:16 PM UTC

w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

Post by admax88q » Mon, Jun 19, 2017, 3:18 PM UTC

pspeter3 wrote: post #22

Nyubis wrote: post #4

The trick of entering a dummy username and password, which is then modified in the post request sounds a whole lot better than playing clipboard roulette or messing with the DOM.

Are they using dummy parameters in the request so they can substitute correctly?

Post by Royalaid » Mon, Jun 19, 2017, 3:22 PM UTC

Santosh83 wrote: post #32

phinnaeus wrote: post #20

Earlier quoted context omitted.

Make sure you read the code of the compiler you're using as well, and bootstrap/compile it from that source instead of trusting an existing compiler binary.

Why stop with compilers? Inspect the circuit diagrams for all your hardware and then make sure the actual manufacturing followed the designs to a tee.