GoKey – A simple vaultless password manager in Go

Re:GoKey – A simple vaultless password manager in Go by bitwidget on Sunday July 10, 2022 @04:50PM (#32048878)

So if I understand correctly, based on the documentation, if someone has the master password and the login url, they can derive all passwords without any 2fa/verification? If so, that seems like a security flaw...

[ Parent | on HN ]

Re:GoKey – A simple vaultless password manager in Go by azophy_2 on Sunday July 10, 2022 @10:15PM (#32051438)

agree. from what understand, if 2 people happen to have the same master password, they would have the same passwords for ALL THEIR ACCOUNTS. pretty scary if you ask me

[ Parent | on HN ]