I just describe these "dumb password requirements" in a file that can be public, and have my DPM generate a password that fits those requirements. See my comment one level up with link.
Re:Design flaws of password managers
by jjoonathan on Sunday January 03, 2021 @12:41PM
(#25623318)
Yeah, which is a considerable inconvenience -- I know because I lived it -- all to achieve zero reduction in effective attack surface.
The file describing the requirements can be public. The requirements themselves are publicly stated.
I'm less concerned about attack surface and more concerned about just not having to deal with the logistics of safely storing and syncing something sensitive that I could also easily lose or not have with me on a mobile device or freshly formatted, self-owned device far away from home. I also don't want to have to trust someone else to store it in the cloud for me, especially if that someone else is handing me a closed-source app to do that.
Re:Design flaws of password managers
by jjoonathan on Sunday January 03, 2021 @07:17PM
(#25626617)
In practice, bitwarden is a heck of a lot easier to get on a new device than a hash app(let) du jour + master password + execption list.
I'd rather have a store that's on another piece of hardware with logging and rate-limiting. Unlike TFA, I'd consider this a strength, not a weakness, but right now the convenience price is extreme.
U2F is good but it's still only a second factor right now and the migration story is abysmal. If they can extend it to serve as a first factor and add a migration story, it would be perfect.