Hacker News Reader

Comment by mrich | Hacker News Reader

With my latest password overhaul I switched to the master password system, not requiring any compromisable database of passwords as with password managers:

http://masterpasswordapp.com/

You can even implement the algorithm yourself if you don't trust the app (which does not require any permissions on Android).

View on HN

Have you seen the comments for this[0] thread?

* What happens when you need to change any single one of those passwords? Don't you need to change all of them?

[0]: https://news.ycombinator.com/item?id=12889807

edit: "any single..." includes the master password itself & any of the individual site passwords for that master password.

There also is a counter used for hashing. So for a new password you just increment the counter. Remembering the counter for every site sounds too complicated, but you could store that in a file without losing much (any?) protection.

Yeah, but then you need to carry the file with you, opening it (especially on mobile) is super clunky, and when you get to a site that doesn't support numbers/letters/whatever that the generator uses, it's hell. I used to use that, but I switched to KeePass2 and it's much better.

Wouldn't you want to maybe... encrypt that file? Seems almost circular unless you use something like stenography to embed the data somewhere. I'm not personally too thrilled by a counter file to replace a different file, at that point I feel like I'm losing features.

I'd recommend reading this article, which discusses some big problems with this approach to password management: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...

That's an interesting read, thanks.

Note that the algorithm/app I mentioned does use the salt mentioned at the end as a possible solution. The counter problem is still there, but I don't feel it is a big issue.

How does that work with stuff such as odd password complexity rules (such as only digits allowed), enforced rotation, leaked password etc? It sounds like it would need to store more state than a master password.

From the same (master password, site identifier) combination you can generate the most common passwords. The app has categories short, medium, long, max, PIN (4 digits), phrase.

Reply on news.ycombinator.com