Re:Pass: A standard Unix password manager
by hiq on Friday July 21, 2017 @08:14AM
(#14819748)
If your master password leaks you are exposed on every website where you used this scheme (and you should then change every password), so on the security side this is inferior to a master password granting access to uncorrelated passwords.
[ Parent
| on HN ]
Well, you can add a salt to this scheme.
I know, it's not perfect, but it beats carrying around password files between devices.
But you would just need to carry the salt around instead. You're just trading convenience for (significantly) lower security.
Yes, it's a trade-off.
By the way, I'd prefer to have a password manager on my phone (or smartwatch), and have it beam my password to my keyboard by NFC. But this solution does not exist yet.
As the other commenter pointed out, you need to carry your salt with you to deduce the actual password. On top of that, you need to keep your salt secret, otherwise it is trivial to deduce your password. So your system [password = hash(master password, salt, domain)] is exactly the same as a master password protecting several other ones. Just use your salt as a password directly at this point...