Re:Lesspass – open-source stateless password manager
by soraminazuki on Sunday March 15, 2020 @05:16AM
(#22582338)
In fact, some password managers (well, at least 1Password) do generate a random secret key that you're required to provide at login in addition to your master password.
Re:Lesspass – open-source stateless password manager
by bsza on Sunday March 15, 2020 @05:47AM
(#22582446)
At which point, I guess, the key has to be either short enough that you can remember it, or stored on a portable device.
Re:Lesspass – open-source stateless password manager
by soraminazuki on Sunday March 15, 2020 @06:58AM
(#22582725)
You need an already logged-in device or a printout of the secret key to login. The former isn't much of a concern because if an attacker has access to a logged-in device, you're screwed anyways. The latter would require physical access to your home, and the same applies here too.
Yes, but in those scenarios we use keys that are truly random. Deriving a symmetric key from a password and encrypting another password with it is simply never going to be as secure. You're better off storing it locally.