Re:Show HN: Dead simple no storage password manager
by mcpherrinm on Wednesday June 03, 2020 @04:51AM
(#23401382)
This appears to be using the passphrase as an hmac key directly, with the URL.hostname as the value.
Unless the user memorizes a proper randomly generated key, this is going to be brute-forcable based on a single website’s generated password, which would then allow all other websites to be accessed.
Also, if a website ever changes its domain name, you’re going to have trouble.
This appears to be a weekend project, and I don’t want to be overly negative, but do not use this as-is. This is more than dead-simple: this is deadly simple.
Unless the user memorizes a proper randomly generated key, this is going to be brute-forcable based on a single website’s generated password, which would then allow all other websites to be accessed.
Also, if a website ever changes its domain name, you’re going to have trouble.
This appears to be a weekend project, and I don’t want to be overly negative, but do not use this as-is. This is more than dead-simple: this is deadly simple.