Re:Spectre: Goodbye Password Managers
by spansoa on Thursday September 07, 2023 @11:03AM
(#37419948)
> Seems like the "Spectre secret" is a massive risk given that compromising it once without detection would compromise EVERY PASSSWORD THAT USER USES, even ones that didn't exist when the secret was stolen.
All password managers have a single point of failure: the master password. This is why 2FA is crucial. Spectre/Master Password doesn't have 2FA, but you can turn it on with all the accounts you have so there is at least that.
Seems like the "Spectre secret" is a massive risk given that compromising it once without detection would compromise EVERY PASSSWORD THAT USER USES, even ones that didn't exist when the secret was stolen.
Followup question: how does Spectre plan to prevent malicious SEO-squatting like we already see in the cryptocurrency space? If this was used widely, I'd assume that the search results for "compute Spectre password" would be 100% stuffed with sites that capture the secret...