News for hackers. Stuff that matters.
Re:Design flaws of password managers by filipo on Sunday January 03, 2021 @02:14AM (#25620177)
DPG seems to be a cool idea but what happens if a website has password requirements like at most/least an uppercase character, a number, no longer than x chars...

As I understand it, you have no control of the output it generates...

Re:Design flaws of password managers by joshlk on Sunday January 03, 2021 @03:37AM (#25620487)
Or if you have to change the password every X months
Re:Design flaws of password managers by tubbyjr on Sunday January 03, 2021 @03:39AM (#25620497)
I think this is a pretty basic capability of most decent DPMs. LessPass for example gives you a counter option to increment and spit out a completely different password for X month update.
Re:Design flaws of password managers by SAI_Peregrinus on Sunday January 03, 2021 @11:14AM (#25622591)
But then it's no longer stateless. So you've lost the primary benefit, while losing the ability to store any other associated secret information in the vault.
Re:Design flaws of password managers by tubbyjr on Sunday January 03, 2021 @02:27AM (#25620216)
https://app.srspass.com is a DPM I found that gives you complete control of the output
Re:Design flaws of password managers by filipo on Sunday January 03, 2021 @03:12AM (#25620412)
Cool seems to work well. My only complaint: there is not much information about who is behind this project and how encryption works... Leading to: what happens if the website is not reachable or goes offline?
Re:Design flaws of password managers by tubbyjr on Sunday January 03, 2021 @03:22AM (#25620437)
I heard about it from a friend of a friend, from my understanding it's just started up, and they're still getting things rolling. Would try contacting them via e-mail or the like if unsure, however, I use it offline on my android, can add it to homescreen and it apparently doesn't need a connection. If they can get the things you mentioned in order, may be an interesting alternative.

I did look at the sources tab, to check out why my laptop was using so much cpu during the decryption phase, and there are some argon2 webworkers that pop up, so some combo of that, and it clearly seems deterministic, since both my phone and laptop produce matching passes, when all params match.

Re:Design flaws of password managers by filipo on Sunday January 03, 2021 @04:14AM (#25620644)
Oh cool you are right. It seems to work in airplane mode. Now the only thing left is the initial load if you switch devices while it has been taken down...

I try to find out more about the project and its story. Thank you

Re:Design flaws of password managers by marioletto on Sunday January 03, 2021 @10:59AM (#25622474)
Where is the unlocking password stored in a web based DPM like this one?