111–117 of 117 posts
Earlier quoted context omitted.
Generally the rule would be hash(master password ++ key).
Then you're just reimplementing a password manager... Badly.
Earlier quoted context omitted.
That's fine until the first time you have to rotate a password, at which point it devolves to, at best, a mnemonic device.
At that point add a 2 to the end or change your username. Worst case you have to try a few times to get in, but eventually you'll remember it's one of those sites that uses the extra version information.
Earlier quoted context omitted.
It's easy. Just come up with a secret rule and derive the passwords from that rule such that the password is different for each website/service.
Then the passwords are not secret, the rule is. And figuring out a rule with a couple of examples is much easier than breaking into an encrypted, properly secured password vault. In case I'm losing you, here's a parallel: if I ask you to pick and remember a random number between 1 and 1 billion, the odds of me figuring it out are low. But if I ask you to pick and remember 200 numbers between 1 and 1 billion, you will…
Earlier quoted context omitted.
If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secur…
> A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. A browser is too complex but an OS and SSH aren't? There are vulnerabilities in both disclosed regularly.
Yes, most certainly.
A browser is running adversarial third party code all the time as a matter of course. While browsers do a good job at isolating, expecting this to be perfect is way too fragile for a security critical requirement like putting all passwords in one basket.
An isolated and minimized OS install, much easier to harden. Never runs any code you don't know about.
Earlier quoted context omitted.
It's easy. Just come up with a secret rule and derive the passwords from that rule such that the password is different for each website/service.
Then the passwords are not secret, the rule is. And figuring out a rule with a couple of examples is much easier than breaking into an encrypted, properly secured password vault. In case I'm losing you, here's a parallel: if I ask you to pick and remember a random number between 1 and 1 billion, the odds of me figuring it out are low. But if I ask you to pick and remember 200 numbers between 1 and 1 billion, you will…
Also, what the rules is is completely up to you. Be inventive.
If it comes to reverse engineering your rule it means you are facing a targeted attack. Believe me, you can't prevent a targeted attack by a good password.
It is better to have one rule to generate a lot of passwords that are good on their own and independent enough than have small number of passwords shared between many services.
Earlier quoted context omitted.
"Adversarial" in this sense is meaningfully different than "dangerous" - at no point is your car trying to outsmart you.
You're right, the car isn't trying to outsmart anyone - physics is trying to outsmart engineers.
Earlier quoted context omitted.
> You can't get more security by trusting more intermediaries with your passwords. I would agree, were it not for the fact that every worthwhile password manager never sends your passwords to any intermediary. There is of course some risk related to the strength of the encryption, software updates/supply chain attacks, client backdoors, etc; however, in most scenarios that is far outweighed by the additional security…
>> every worthwhile password manager never sends your passwords to any intermediary Except in cases where the password manager is 100% open source, the people who wrote the password manager are intermediaries. As I said, you need to trust an additional intermediary.