News for hackers. Stuff that matters.
Re:Master Password by bdcravens on Saturday June 27, 2015 @01:15AM (#9789212)
Ok, I get it - it doesn't retrieve anything. It basically hashes you a password using what is public and a secret (your password). I need to see if it's possible to change your password on a per site basis - it seems that would require changing globally (since you'll need to update the secret)
Re:Master Password by nacs on Saturday June 27, 2015 @02:54AM (#9789346)
Their algorithm page [1] contains this:

> The site's password counter (default: 0): This is an integer that can be incremented when the user needs a new password for the site.

So it looks like you can generate new passwords anytime you want on a per site basis.

[1]: https://ssl.masterpasswordapp.com/algorithm.html

Re:Master Password by singlow on Saturday June 27, 2015 @02:54AM (#9789348)
it has an additional counter that can be incremented per site
Re:Master Password by spectralblu on Saturday June 27, 2015 @03:46AM (#9789424)
This seems incredibly awkward to me.

Several of the design goals for this app were to eliminate the need for sync, as you're able to fairly easily replicate the initial seeds/salts for password generation (your full name, your master password, and the site base domain).

I'm not really seeing any pros using this solution...

Con 1: You can't use any password you want (for whatever reason, be it stupid password security requirements, your boss gave you a password to use, you're not allowed to change something, the list goes on) Con 2: They focus on not requiring sync, and concessions were made for this (a bunch of defaults, as well as con 1 from above) when they really actually do require sync. The password counter and password type (strong, weak, etc) both need to be synced to actually derive a password.

If we're going to have to sync these to reliably store our passwords, then why not just go with an actual password manager without any of these arbitrary limitations?

I've been using 1Password and its been working out great for me. (Arguments may be made about its closed source, but KeepassX functions in a similar manner).

Re:Master Password by tzs on Saturday June 27, 2015 @04:09AM (#9789448)
> Con 1: You can't use any password you want (for whatever reason, be it stupid password security requirements, your boss gave you a password to use, you're not allowed to change something, the list goes on)

It does cover that:

   My boss gave me this password to use...

   Master Password's generated passwords only work if
   you use the password generated for you. You cannot
   use a password somebody else gave you.

   Only - you can: Master Password implements a hybrid
   solution, allowing you to save custom passwords in the
   app. They are AES encrypted with your master key, but
   like all vault-based password managers, are not immune
   to loss if you ever lose your phone and backups..
Of course that introduces a vault and presumably a need to sync if you want to access that password from multiple computers or mobile devices.