Hacker News new | past | comments | ask | show | jobs | submit login

This is a long blog post that talks about some drawbacks of this approach: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...

Before reading this I was convinced that stateless deterministic approaches like these was the ideal. But some arguments in that post changed my mind.




> Deterministic password generators cannot accommodate varying password policies without keeping state

16 characters + 'Aa$1' has universally satisfied every website I have used to date except Baidu (which imposes a maximum of 16 characters total on passwords). The number of exceptions to this is probably miniscule.

> Deterministic password generators cannot handle revocation of exposed passwords without keeping state

That's what 'n' is for. Either you can keep 'n' as a state variable which is much easier to manage (and if you lose the file, you can try a few values of n and get yourself back into those websites without much hassle), OR sync the values of n every several months on the sites that use it.

> Deterministic password managers can’t store existing secrets

This is orthogonal to the password problem. I store sensitive files that aren't passwords in a GPG-encrypted tarball on Dropbox.

> Exposure of the master password alone exposes all of your site passwords

This is true of stateful password managers as well, if you backup your database on anywhere insecure or any device (e.g. laptop) that could potentially be mugged at gunpoint, confiscated by border control, leaked by buggy software, etc.


He's uses _n_ for state, so it's not really state-less (in fact, issues 1 and 2 don't apply).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: