Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I may be wrong, the idea is interesting but looks more like a password generator and a terrible password manager to me.

You still need to store somewhere informations like url, username, counter, etc. right ? Can you change the master password without changing all your accounts password ? If one happens to find your master password, he's basically able to get/generate all your passwords just like a normal pw manager with no 2FA, correct ?



You have it right. This master password derived passwords idea is nothing new. Few people actually use it because it's not actually a great idea for the reasons you listed.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: