The general idea is that a function
hash("my_master_password", "facebook.com") could deterministically give you the password for your account at any website.
Avoids a keystore like Keepass or LastPass which have their own risks inherent to password storage
Still provides unique password per website account
Can't update your password on a specific site
If someone discovers your master password then they have your password for all accounts
Is there a password manager that combines this idea with a keystore solution to address these drawbacks?
It would effectively mean a password generation function
hash("my_master_password", "facebook.com", "facebook.com_password_from_keystore")
my_master_password would not be stored anywhere, so you must memorize it or store outside the system. The keystore would have separate login key
keystore_password in order to fetch the remaining arguments
If keystore is compromised there is still no way for attacker to discover "my_master_password" so you have more time to reset your passwords once attack is discovered
Cycle passwords by generating new random value for
I would consider using a product like this because I like that there is information in the scheme that is never stored in or sent to a keystore. What are some additional drawbacks?
Additional Context: I don't think I really understand why solutions like LastPass or KeePass are trusted as much as they seem to be. I see how they are a great solution for the problem of password uniqueness and complexity, but there have been breaches on LastPass and other popular file storage solutions that may be common for storing KeePass files.