Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Well, you can add a salt to this scheme.

I know, it's not perfect, but it beats carrying around password files between devices.



But you would just need to carry the salt around instead. You're just trading convenience for (significantly) lower security.


Yes, it's a trade-off.

By the way, I'd prefer to have a password manager on my phone (or smartwatch), and have it beam my password to my keyboard by NFC. But this solution does not exist yet.


As the other commenter pointed out, you need to carry your salt with you to deduce the actual password. On top of that, you need to keep your salt secret, otherwise it is trivial to deduce your password. So your system [password = hash(master password, salt, domain)] is exactly the same as a master password protecting several other ones. Just use your salt as a password directly at this point...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: