Hacker News new | ask | show | jobs
by spectralblu 4006 days ago
This seems incredibly awkward to me.

Several of the design goals for this app were to eliminate the need for sync, as you're able to fairly easily replicate the initial seeds/salts for password generation (your full name, your master password, and the site base domain).

I'm not really seeing any pros using this solution...

Con 1: You can't use any password you want (for whatever reason, be it stupid password security requirements, your boss gave you a password to use, you're not allowed to change something, the list goes on) Con 2: They focus on not requiring sync, and concessions were made for this (a bunch of defaults, as well as con 1 from above) when they really actually do require sync. The password counter and password type (strong, weak, etc) both need to be synced to actually derive a password.

If we're going to have to sync these to reliably store our passwords, then why not just go with an actual password manager without any of these arbitrary limitations?

I've been using 1Password and its been working out great for me. (Arguments may be made about its closed source, but KeepassX functions in a similar manner).

1 comments

> Con 1: You can't use any password you want (for whatever reason, be it stupid password security requirements, your boss gave you a password to use, you're not allowed to change something, the list goes on)

It does cover that:

   My boss gave me this password to use...

   Master Password's generated passwords only work if
   you use the password generated for you. You cannot
   use a password somebody else gave you.

   Only - you can: Master Password implements a hybrid
   solution, allowing you to save custom passwords in the
   app. They are AES encrypted with your master key, but
   like all vault-based password managers, are not immune
   to loss if you ever lose your phone and backups..
Of course that introduces a vault and presumably a need to sync if you want to access that password from multiple computers or mobile devices.