News for hackers. Stuff that matters.

A comment on Disqus Security Alert: User Info Breach. Parent comment

Re:Disqus Security Alert: User Info Breach by zootboy on Friday October 06, 2017 @08:05PM (#15421391)
Except this all but negates the benefits of a password manager. Now if someone steals your master password, they can generate every single password you use.

Use something like Keepass / KeepassXC. Yes, it's somewhat less convenient, but remember that security and convenience are always a trade-off.

[ Parent | on HN ]
Re:Disqus Security Alert: User Info Breach by jMyles on Friday October 06, 2017 @08:10PM (#15421413)
> Except this all but negates the benefits of a password manager.

It preserves the main benefit: that I no longer need to remember a separate password for each domain in order to stop sharing passwords across them.

> Now if someone steals your master password, they can generate every single password you use.

So it's just a matter of keeping the seed in the user's head and nowhere else. Right?

That doesn't seem to be any more serious a security challenge than keeping secure an encrypted datastore full of passwords.

[ Parent | on HN ]
Re:Disqus Security Alert: User Info Breach by shkkmo on Friday October 06, 2017 @08:30PM (#15421517)
> So it's just a matter of keeping the seed in the user's head and nowhere else. Right?

Until you enter it on a compromised system to generate a password...

[ Parent | on HN ]