News for hackers. Stuff that matters.

A comment on Show HN: A password system with no database, no sync, and nothing to breach.

Re:Show HN: A password system with no database, no sync, and... by collingreen on Friday February 06, 2026 @09:19PM (#46920680)
I made one of these once and stopped using it for some of the same reasons folks have in the comments:

- losing the master is catastrophic - sign ins with dumb password rules meant I had to sync metadata - a bad actor knowing my resulting password, their site, my username, and potentially my password version meant in theory they could brute force offline and see if they could infer my master - I had to do silly things to use my passwords on not-my-device - getting my password on not-my-device felt extremely dangerous

[ Parent | on HN ]
Re:Show HN: A password system with no database, no sync, and... by KevinChasse on Friday February 06, 2026 @10:32PM (#46921059)
Bastion has the same failure model as a hardware wallet or SSH private key. If you want recoverability, you accept third-party trust. Bastion refuses that trade.
[ Parent | on HN ]