Re:Lesspass – open-source stateless password manager
by soraminazuki on Sunday March 15, 2020 @05:08AM
(#22582303)
It's a vast improvement over the traditional alternative of people reusing passwords across sites IMHO. It's hard enough to get non-technical people to use passwords managers. The chance of getting people to use a password manager without a usable syncing capability is virtually none.
[ Parent
| on HN ]
Re:Lesspass – open-source stateless password manager
by bsza on Sunday March 15, 2020 @05:44AM
(#22582429)
It is an improvement, for sure. And probably good enough for the average user.
On the other hand, if convenience is important, then I see no obvious difference between an online password manager and the OP's solution. In both cases, the security of your password vault depends directly on the security of your master password.
Re:Lesspass – open-source stateless password manager
by soraminazuki on Sunday March 15, 2020 @06:51AM
(#22582699)
I don't think that assumption is true because it should be far more easier to brute force the master password of a deterministic password manager. Worse, the OP's solution accepts "password" as a master password, which means that many, many people are going to have the same generated passwords if this gets widely adopted.
Re:Lesspass – open-source stateless password manager
by bsza on Sunday March 15, 2020 @11:37AM
(#22584015)
That's... not reassuring. Though I would still argue that that is more of an implementation issue, not a deal-breaker for the general idea. And there are many KDF variants that (claim to) offer protection against brute force, so that's not necessarily an issue either (but I do agree it sounds risky).