Re:Lesspass – open-source stateless password manager
by soraminazuki on Sunday March 15, 2020 @06:51AM
(#22582699)
I don't think that assumption is true because it should be far more easier to brute force the master password of a deterministic password manager. Worse, the OP's solution accepts "password" as a master password, which means that many, many people are going to have the same generated passwords if this gets widely adopted.
[ Parent
| on HN ]
Re:Lesspass – open-source stateless password manager
by bsza on Sunday March 15, 2020 @11:37AM
(#22584015)
That's... not reassuring. Though I would still argue that that is more of an implementation issue, not a deal-breaker for the general idea. And there are many KDF variants that (claim to) offer protection against brute force, so that's not necessarily an issue either (but I do agree it sounds risky).