Re:Cryptopathic: The situation at LastPass may be worse than...
by toleda on Saturday December 24, 2022 @01:05AM
(#34114443)
I may be wrong, the idea is interesting but looks more like a password generator and a terrible password manager to me.
You still need to store somewhere informations like url, username, counter, etc. right ?
Can you change the master password without changing all your accounts password ?
If one happens to find your master password, he's basically able to get/generate all your passwords just like a normal pw manager with no 2FA, correct ?
Re:Cryptopathic: The situation at LastPass may be worse than...
by ziml77 on Saturday December 24, 2022 @10:05AM
(#34117417)
You have it right. This master password derived passwords idea is nothing new. Few people actually use it because it's not actually a great idea for the reasons you listed.
You still need to store somewhere informations like url, username, counter, etc. right ? Can you change the master password without changing all your accounts password ? If one happens to find your master password, he's basically able to get/generate all your passwords just like a normal pw manager with no 2FA, correct ?