Hacker News Reader

Comment by giberson | Hacker News Reader

Could someone detail the process of "sharing a masked password", or at least how it would theoretically be implemented as a feature? I'm not quite sure I get the scenario. Is the masked password to access passpack user account? Or is it to access some site passpack is managing a password for?

View on HN

It seems to be some sort of utter nonsense imagined by someone who has no idea how any of this works. Well written article, but I don't see why it's worth taking the time to address this.

You overestimate people's understanding of security. Clearly Passpack have had enough customers request the feature or complain about its absence to be worth writing about it.

The customers don't care about the particular method, they just know what they want to accomplish and try to suggest how they think it may work. It's beside the point and somewhat obtuse to go into detail explaining why a particular way doesn't work.

A much better way to respond to this request would be 'Yes! Here's a one time/time limited password generator that will do what you want'.

passpack already provides the ability to generate one-time passwords.

Great, what I'm saying is they should steer their customers towards the solution and not bother refuting inanity.

I think what they want to do is temporarily grant someone else the ability to authenticate using their passpack account, without actually exposing the passwords.

This is, of course, not possible in the general case. You can (sort of) do it for a specific site by changing the password and changing it back when you're done, which is what I ask people to do whenever they want me to poke around in their accounts. That obviously doesn't generalize across sites.

It is 100% possible actually. They are called temporary generated one-use passwords.

That is a feature that must be implemented by the service in question; it's impossible for a password manager to do it in the general case.

Reply on news.ycombinator.com