How bad is the following strategy for a password manager on a local machine?
The user wants to sign up for somesite.com where he needs a password.
The user has previously generated a secret key
K which he remembers and isn't stored anywhere. Now using a good hash function the site's URL somesite.com is hashed together with
K to form the password used for the site.
This way passwords are never stored and can be recalled on a per-site basis from the secret key.