Posted by Bogdanp 13 hours ago
There are some pass apps for Android, but they're a pain to use.
1. https://apps.apple.com/us/app/pass-password-store/id12058205...
This app is keeping me on iOS as there is no single-app replacement on Android afaik.
Edit: looks like there’s a community fork now! https://github.com/agrahn/Android-Password-Store
works great.
[1]: https://apps.apple.com/us/app/pass-password-store/id12058205...
No ipad version I've found supports yubikey either
- what if some site has weird password requirements and the derived password doesn’t work
- what if a site gets hacked and you need to rotate one password.
If you have to store data per-site anyway because of those cases, may as well just store passwords. You can (and should) still generate extremely high entropy passwords.
- if your secret leaks and you don't know it (or you do know, but you need some time to change it), the attacker not only gets the snapshot of your password manager but also can derive all future passwords you'll generate, or past ones you long forgot about
- there's no way to know what you've entered before, since it's stateless. With data stored in a manager, I know what username I used and can associate other data. If your uniqueifying input is the domain, and let's say HN would become hn.yc or whatever and you visit it again in ten years, you'd have to remember that hn.yc accepts the password of what you entered as news.ycombinator.com
I have to admit though, hash(name+secret)=password is so simple and beautiful that it draws IT people like a fine artwork draws visitors. But for me, that doesn't outweigh the practical issues