1
$\begingroup$

How bad is the following strategy for a password manager on a local machine?

The user wants to sign up for somesite.com where he needs a password. The user has previously generated a secret key K which he remembers and isn't stored anywhere. Now using a good hash function the site's URL somesite.com is hashed together with K to form the password used for the site. This way passwords are never stored and can be recalled on a per-site basis from the secret key.

Improve this question
$\endgroup$
3
  • $\begingroup$ How is somesite.com "hashed together with K"? $\;$ $\endgroup$
    – user991
    Commented Oct 30, 2014 at 6:29
  • 2
    $\begingroup$ I would assume using the key in HMAC with the site name as the plaintext?. It should be noted I designed a scheme around this idea, there are a lot of complexities involved, like site password character and length restrictions, among other things $\endgroup$
    – Richie Frame
    Commented Oct 30, 2014 at 6:37
  • $\begingroup$ Related: crypto.stackexchange.com/questions/9035/… ... and I guess basically every question containing the words "password generation", as this is hardly a novel concept $\endgroup$
    – Thomas
    Commented Oct 30, 2014 at 7:06

1 Answer 1

Reset to default
1
$\begingroup$

For the sake of this answer I shall suppose that the domain of "somesite.com" is used as the salt to some password-based key derivation function.

Now this has the usual problems of deterministic password managers: As soon as one site is breached, you need a different password for that site meaning either the site needs to change their URL (unlikely) or you need to remember an additional piece of information to derive the password for this particular site or you need to change your master password which will also force you to change passwords on all other sites you use, including those you no longer remember you actively use but still do from time to time where you're locked out with the new master password.

If you want more information why deterministic password management might not be a smart idea, have a look at this blog post.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ What if we just required the operators of every site that gets breached, by law, to change their name to include a counter of the number of times they've been breached? This way they get to carry a badge of shame for lax security practices. Kill two birds with one stone! $\endgroup$
    – Squeamish Ossifrage
    Commented Nov 5, 2017 at 23:26
  • 1
    $\begingroup$ Also, sites have specific password policies. If all you have is an URL, you won't be able to derive a password matching the silly rules the website requires for passwords. $\endgroup$
    – Frank Denis
    Commented Nov 6, 2017 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.