I like LastPass but having to have it as a browser plugin means an attacker could steal all my passwords at once. It makes a lot of sense to use a hardware device to store my passwords, like yubikey does. But then losing it would be a problem.
The best way would be to use yubikey to deterministically generate a password for each site given the site's URL, my username and some nonce so I can change passwords for an specific site if I have to.
I know that yubikey has some sort of challenge response but it cannot be backed up like an open gpg curve.
I'd like to know if there are solutions to this problem that does what I said but using RSA with yubikey/others, and what are the possible flaws. For example, my password on each site would be soething like this:
hash(rsa_signature(url, username, nonce))[0,n]
that is, my password would be the first
n characters of the hash of the signature of the
nonce concatenated together. The hash would be good to anonimize me so my signature can't be tested against my public key. Such a service would only have to keep track of
n for each
I've read some posts about this, so please don't mark as duplicate:
Is this idea for a password manager secure? If so, why doesn't anybody use it? - not for hardware devices, so keyloggin is an issue. Not in my scheme.
Password Managers: encrypted database vs hashing strategy - no mention about nonce