Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Which is its greatest weakness IMO since a compromise of the master key means all accounts using that key are vulnerable. And one doesn't need the key database to get it. It could be guessed.

With passwords an attacker has to guess each site independently, or gain access to the password database and the decryption password.

IIRC the SQRL file itself is like a database of master keys so one can change them in an orderly way. But the idea is to have only one, or a few.



Which is why the master key shouldn't reside everywhere.

But this is no different from any other password manager. Once you have the master password, you can access everything else.

The difference in my opinion is that because you would only leave this master key on one device, preferably a hardware protected, encrypted device like an iphone, stealing this key is significantly difficult. Whereas with a password manager, you have to type your credentials on a machine open to malware and key loggers.


That's a common criticism of any stateless system, like the Master Password algorithm.

I made https://github.com/myfreeweb/freepass which is based on that algorithm but also generates keys, not just passwords — Ed25519 keys for SSH, signify, and I wanted to add SQRL but haven't got around to that yet.

Some people like to say that "omg if your master password gets stolen with this, that's it, but with a classic file-based password manager they also have to steal the database file". However…

If the stealing happens via keylogger malware, THAT MALWARE CAN ALSO STEAL THE DB FILE, for fuck's sake.

If the stealing happens via someone looking over your shoulder / recording how you enter the password with a surveillance camera, they also have to know your "full name" which can be whatever string you want, it's stored on your device and isn't visible when entering the password.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: