Hacker News Reader

It seems like this relies on an attacker being able to compromise one machine, but not another. Given that these machines are supposed to be quite similar (they're both password databases running the same software), what makes that a reasonable assumption?

View on HN

The article suggests that the two machines could be running different operating systems and be placed on different networks/locations to reduce the chances of a single attack compromising both systems.

It seems really unlikely that any of these leaks has been due to a security flaw in the operating system. I'd think that even in this scheme if an admin account or authentication process is compromised, then the attacker's going to have access to both password stores.

Well, no, because it's a write only model. If the admin account becomes compromised there is no way to read the passwords back. That is of course unless you have root access to both machines, in which case the password can be salted + hashed and then split and stored.

Reply on news.ycombinator.com