An idea I've had for a while is a password generator where you take a master password, an optional per site password, and the site domain name, combine and hash them to get a unique password for any site.
This system has a unique benefit over traditional password managers in that you can't lose your passwords. Even if all your electronics were destroyed and you woke up naked in China tomorrow you could get your passwords just by using an online version of the tool (or failing that, manually doing the steps yourself with a hash generator).
However, the system has a unique drawback of not remembering what the password requirements are. Some sites require special characters, some don't allow them, some require more than 10 characters, some allow for a max of 8. It would be easy to translate your hash into whatever set of requirements you have, but you still need to either remember that, or store it somewhere else.
Today I discovered this idea has been implemented, a lot. It's called a stateless password manager, or a deterministic password manager. Two examples are:
https://masterpassword.app/
https://lesspass.com/#/
And here is an article discussing the flaws in this system:
https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers
Saturday, April 4, 2020
Subscribe to:
Posts (Atom)