There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools.
The general idea is that a function hash("my_master_password", "facebook.com")
could deterministically give you the password for your account at any website.
Benefits:
Avoids a keystore like Keepass or LastPass which have their own risks inherent to password storage
Still provides unique password per website account
Drawbacks:
Can't update your password on a specific site
If someone discovers your master password then they have your password for all accounts
Is there a password manager that combines this idea with a keystore solution to address these drawbacks?
It would effectively mean a password generation function hash("my_master_password", "facebook.com", "facebook.com_password_from_keystore")
my_master_password
would not be stored anywhere, so you must memorize it or store outside the system. The keystore would have separate login key keystore_password
in order to fetch the remaining arguments facebook.com
and facebook.com_password_from_keystore
.
Benefits:
If keystore is compromised there is still no way for attacker to discover "my_master_password" so you have more time to reset your passwords once attack is discovered
Cycle passwords by generating new random value for
facebook.com_password_from_keystore
I would consider using a product like this because I like that there is information in the scheme that is never stored in or sent to a keystore. What are some additional drawbacks?
Additional Context: I don't think I really understand why solutions like LastPass or KeePass are trusted as much as they seem to be. I see how they are a great solution for the problem of password uniqueness and complexity, but there have been breaches on LastPass and other popular file storage solutions that may be common for storing KeePass files.