Re:Lesspass – open-source stateless password manager
by soraminazuki on Sunday March 15, 2020 @06:51AM
(#22582699)
I don't think that assumption is true because it should be far more easier to brute force the master password of a deterministic password manager. Worse, the OP's solution accepts "password" as a master password, which means that many, many people are going to have the same generated passwords if this gets widely adopted.
Re:Lesspass – open-source stateless password manager
by bsza on Sunday March 15, 2020 @11:37AM
(#22584015)
That's... not reassuring. Though I would still argue that that is more of an implementation issue, not a deal-breaker for the general idea. And there are many KDF variants that (claim to) offer protection against brute force, so that's not necessarily an issue either (but I do agree it sounds risky).
On the other hand, if convenience is important, then I see no obvious difference between an online password manager and the OP's solution. In both cases, the security of your password vault depends directly on the security of your master password.