Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"we've built the entire internet and banking systems around it"

Yes, but in those scenarios we use keys that are truly random. Deriving a symmetric key from a password and encrypting another password with it is simply never going to be as secure. You're better off storing it locally.



In fact, some password managers (well, at least 1Password) do generate a random secret key that you're required to provide at login in addition to your master password.


At which point, I guess, the key has to be either short enough that you can remember it, or stored on a portable device.


You need an already logged-in device or a printout of the secret key to login. The former isn't much of a concern because if an attacker has access to a logged-in device, you're screwed anyways. The latter would require physical access to your home, and the same applies here too.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: