Hacker News Reader

All such deterministic algorithms are seeded by something. This is their basic flaw. Guess the seed and you get all the passwords.

With a password manager that randomly generates unique passwords, you don't have that problem, but you do have to synchronize the data.

View on HN

The master password of the password manager has the same issue plus the burden of storage.

and the virtue of allowing a single point of 2FA.

the seed is just the seed, and will always be the seed. the master password can change and be supplemented by 2FA / other enhancement schemes.

I'm not sure we're talking about the same thing. See the code I posted. There is no unchangeable static seed.

It's not the same issue. With your approach, a compromise of the seed is catastrophic and reveals everything. With a regular password manager, you also need access to the vault encrypted using that master password. That's not a given -- most password managers either store their vaults locally or offer 2FA when synced.

(Nevermind that you can't change individual passwords or the master password at will with a deterministic scheme.)

Reply on news.ycombinator.com