Skip to main content
deleted 193 characters in body
Source Link
Nobody
  • 702
  • 4
  • 10

Couple points about the question, too long for a comment, some stuff has already been mentioned separately:

  • has been done lots of times, there are tools available
  • from one leaked password the other passwords could in theory be compromised if someone guesses how and what you are hashing to get the passwords and then uses brute-force. Still much better than reusing passwords.
  • if the master password (plus salt and hashing algorithms and whatever you set up. I've written a program years ago which took a master password and a domain name and combined this with a salt stored in the executable and lots of rounds of various hashing algorithms chained) is contaminated, the the attacker doesn't just know your current passwords, but even ones you are going to set up in the future
  • you can't easily change one single password. This seems to be the biggest usage drawback to me
  • because of stupid password rules, sometimes you can't use the generated password. You can almost always get around this by generating multiple passwords according to different rules (say a 20-char alphanumeric and a 20-char ascii printable character password, and then use the maximum length and complexity which a website supports), but this is annoying because then sometimes you need multiple tries to get your own passwords right.

All in all, I think it's probably inferior to password databases for practical reasons but with similar security.

If you want to improve the security of password managers, I suggest you use a hardware based one. Probably those exist. Before building or buying one also consider just using a traditional notebook, it's pretty secure against any kind of hacker attack...

Couple points about the question, too long for a comment, some stuff has already been mentioned separately:

  • has been done lots of times, there are tools available
  • from one leaked password the other passwords could in theory be compromised if someone guesses how and what you are hashing to get the passwords and then uses brute-force. Still much better than reusing passwords.
  • if the master password (plus salt and hashing algorithms and whatever you set up. I've written a program years ago which took a master password and a domain name and combined this with a salt stored in the executable and lots of rounds of various hashing algorithms chained) is contaminated, the the attacker doesn't just know your current passwords, but even ones you are going to set up in the future
  • you can't easily change one single password. This seems to be the biggest usage drawback to me
  • because of stupid password rules, sometimes you can't use the generated password. You can almost always get around this by generating multiple passwords according to different rules (say a 20-char alphanumeric and a 20-char ascii printable character password, and then use the maximum length and complexity which a website supports), but this is annoying because then sometimes you need multiple tries to get your own passwords right.

All in all, I think it's probably inferior to password databases for practical reasons but with similar security.

If you want to improve the security of password managers, I suggest you use a hardware based one. Probably those exist. Before building or buying one also consider just using a traditional notebook, it's pretty secure against any kind of hacker attack...

Couple points about the question, too long for a comment, some stuff has already been mentioned separately:

  • has been done lots of times, there are tools available
  • from one leaked password the other passwords could in theory be compromised if someone guesses how and what you are hashing to get the passwords and then uses brute-force. Still much better than reusing passwords.
  • if the master password (plus salt and hashing algorithms and whatever you set up) is contaminated, the the attacker doesn't just know your current passwords, but even ones you are going to set up in the future
  • you can't easily change one single password. This seems to be the biggest usage drawback to me
  • because of stupid password rules, sometimes you can't use the generated password. You can almost always get around this by generating multiple passwords according to different rules (say a 20-char alphanumeric and a 20-char ascii printable character password, and then use the maximum length and complexity which a website supports), but this is annoying because then sometimes you need multiple tries to get your own passwords right.

All in all, I think it's probably inferior to password databases for practical reasons but with similar security.

If you want to improve the security of password managers, I suggest you use a hardware based one. Probably those exist. Before building or buying one also consider just using a traditional notebook, it's pretty secure against any kind of hacker attack...

Source Link
Nobody
  • 702
  • 4
  • 10

Couple points about the question, too long for a comment, some stuff has already been mentioned separately:

  • has been done lots of times, there are tools available
  • from one leaked password the other passwords could in theory be compromised if someone guesses how and what you are hashing to get the passwords and then uses brute-force. Still much better than reusing passwords.
  • if the master password (plus salt and hashing algorithms and whatever you set up. I've written a program years ago which took a master password and a domain name and combined this with a salt stored in the executable and lots of rounds of various hashing algorithms chained) is contaminated, the the attacker doesn't just know your current passwords, but even ones you are going to set up in the future
  • you can't easily change one single password. This seems to be the biggest usage drawback to me
  • because of stupid password rules, sometimes you can't use the generated password. You can almost always get around this by generating multiple passwords according to different rules (say a 20-char alphanumeric and a 20-char ascii printable character password, and then use the maximum length and complexity which a website supports), but this is annoying because then sometimes you need multiple tries to get your own passwords right.

All in all, I think it's probably inferior to password databases for practical reasons but with similar security.

If you want to improve the security of password managers, I suggest you use a hardware based one. Probably those exist. Before building or buying one also consider just using a traditional notebook, it's pretty secure against any kind of hacker attack...

Post Made Community Wiki by Nobody