Hacker News Reader

Comment by dr_hooo | Hacker News Reader

I've been wondering is there any disadvantage in using password hashers (either as plugins like [0] or standalone) for generating safe passwords? It seems like a great idea to me, yet most people here seems to be prefer full blown PW manager apps or even online services for this. Am I missing something?

[0] https://chrome.google.com/webstore/detail/password-hasher-pl...

View on HN

The main problems I find with hashers are:

* No way to change password without storing things

* No way to handle site-specific rules without storing things

* No way to store auxiliary data (URLs, usernames, etc.)

* No way to see which sites you have accounts on

Makes sense, from a usability PoV, thanks.

I consider them more insecure than a reasonably well made password manager, all that is between you and any possible site you will ever register on or have registered on, is a master password.

On the other hand, I can change my Lastpass/Keepass password regularly, denying a cracker access to my accounts in the future.

The security of any password manager, including hashers, is not only how secure it is against attacks, but how secure it is after it has been successfully attacked and how easy it is to recover full security without losing too much data.

Here is a writeup: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...

Because it also needs to store a database. No reduced complexity at all.

In its most basic form it just requires a key file and an algorithm. But I agree that more complex operations need some DB.

Reply on news.ycombinator.com