Now, I personally couldn't pull this off, but I'd actually love to see the Math done here.
[1] Video: http://twit.tv/show/security-now/315 Transcript: http://www.grc.com/sn/sn-315.htm
Now, I personally couldn't pull this off, but I'd actually love to see the Math done here.
[1] Video: http://twit.tv/show/security-now/315 Transcript: http://www.grc.com/sn/sn-315.htm
Also note that it's frequently said that anyone can make a cryptosystem secure enough that the creator themselves cannot break it. So I wouldn't fully trust this without further analysis. I don't really like how much key material is exposed to the sites, though...
But that's not really the point. The real problem is that this is a _lot of work_. The real problem with passwords is not that generating them is hard. There's no end to systems to generate passwords. Here's an easy one: Print out a list of 6^4 common English words. Roll 4 dice to select one. Repeat four times. There's your password.
No, the real problem is compliance. Remembering passwords is hard, so people don't bother. Regenerating passwords each time with this "Off The Grid" system is also hard. So people won't bother. It is _far better_ to have a password management app than to halfheartedly use a system like this but eventually give up and go back to using the same password everywhere.
You're absolutely right about its use for password generation & management. I suppose the scheme might still have other uses where the proverbial "off the grid" aspect indeed strengthens security? Are those relevant at all?