This question already has an answer here:
The goal of a password manager is to reduce the number of passwords which one must memorize down to one, and then have all other passwords be encrypted under that master password. My solution aims to solve the same process without the use of any data storage.
First, generate a secure password. Then, conconcatenate the name of the account to the end of it and hash the result, possibly in the chain-style outlined in this answer. The final result would be my password for that account.
Using an example password "GreenPlanetAboutStudentCaughtGoodbye" and my "StackExchange" account, I would hash "GreenPlanetAboutStudentCaughtGoodbyeStackExchange", and use the result as my password.
The purpose of the hashing is to ensure that even if a website were to store my password in plaintext, only that password would be compromised. Assuming that accounts allow for all 40 characters of a SHA-256, the entropy of the passwords would be
max(256, entropy of initial password).
- Requires no encryption
- Requires no data storage
- Passwords can only be lost if the master password is forgotten
- Can be used anywhere
- Dependent on websites allowing for unlimited password length (though one could trim the hash for websites which require it)
- Assumes all special character reqs will be met by the random password (highly likely but still a chance they won't)
Is my idea sound (reasonably secure)? Is there any critical flaw which I am missing?