Password managers are not without security flaws, as seen in a recent high-profile breach. The database storing all the user's passwords is a very attractive target for hackers. Spectre is a new password manager that aims to solve this problem by using a unique password generation and management approach.
It sounds like a cool concept, but I can’t see anyone migrating to this service since there is no logical way to import your current passwords.
So basically a fancy hashing algorithm to get the same password for the same information you give it. Neat idea but I am not convinced yet.
If your Spectre secret gets somehow leaked (and your full name could easily be found), that’s immediately all your current and future passwords leaked. Now, this would in theory also be a problem with regular password managers that live in the cloud. Though smart ones hopefully add 2FA or similar before they let their users log in. For offline password managers the hacker would need your secret + database to get your password. That’s a lot harder. Spectre takes one of those items away, because the ‘database’ is their algorithm which literally runs on their webpage. All they need is a single password.
What if a site you use leaks your password and you have to change your password for that site only? Spectre won’t help you with that, as it will still give you the (burned) password. So you manually have to remember which sites use Spectre for passwords and which ones don’t.
Have any services that have been provided to you with a set password you can’t change (eg: some service your job uses), Spectre won’t help you with this as it won’t hold any custom passwords. Have any weird services that requires a specific length and/or forbidden characters Spectre does? Good luck, Spectre can’t help you here either. It’s not a password manager.
I think they are only talking about your username, not your actual name.
What if a site you use leaks your password and you have to change your password for that site only? Spectre won’t help you with that, as it will still give you the (burned) password.
That is something I immediately thought about, there is no way to change a single password. All or nothing.
Good luck with hundreds of passwords that would need changing.
Which is kinda interesting, they mention site-counter and site-template. The counter indicates you can set it to a different value to get a different password for that site. But then obviously every time you want to recall that password, you have to set the site counter correctly. I guess the app will remember this, but the web version obviously doesn’t. But the gimmick is that it doesn’t store anything, but it seems for the app to work it does need to store the settings to generate your password.
And also there is a site-template, which seems to hold various ways to generate passwords. Long, medium, short, pin, etc etc. With or without special symbols. It even mentions ‘saved personal password’ so I guess it can save custom passwords? Hopefully encrypted though.
That sorta addresses the concerns I have. But obviously that means you need the app, the website doesn’t do all those extra things. And if you loose the app you loose your custom site counter and template.
Also, the CLI version seems to happily store the username and secret on your pc? Or at least lets you read it from a file, so…
(I haven’t actually used the app, just going through some docs and source code here)
If one password is leaked, it should let you change the key for just that one service. Eventually, you could have a bunch of different keys for different service. But then you will need some manager for remembering all those different secrets. Yay!
I see they have a counter that maybe you can set? Then I guess you just need a manager to store the counters, which seems fundamentally the same
See my response a few comments down this thread. I found the counter and password-template too. I don’t have an iphone so I can’t test the app, but I very much think this app stores the ‘settings’ (counter, template) to generate the password. Based on what the api and CLI can do… it has to, surely. It also has the ability to retrieve a custom password.
Of course the webapp in the link doesn’t do all of that. You’re stuck with 1 password in 1 format. Unless you change your secret and then all your passwords change.
So basically a fancy hashing algorithm to get the same password for the same information you give it. Neat idea but I am not convinced yet.
If your Spectre secret gets somehow leaked (and your full name could easily be found), that’s immediately all your current and future passwords leaked. Now, this would in theory also be a problem with regular password managers that live in the cloud. Though smart ones hopefully add 2FA or similar before they let their users log in. For offline password managers the hacker would need your secret + database to get your password. That’s a lot harder. Spectre takes one of those items away, because the ‘database’ is their algorithm which literally runs on their webpage. All they need is a single password.
What if a site you use leaks your password and you have to change your password for that site only? Spectre won’t help you with that, as it will still give you the (burned) password. So you manually have to remember which sites use Spectre for passwords and which ones don’t.
Have any services that have been provided to you with a set password you can’t change (eg: some service your job uses), Spectre won’t help you with this as it won’t hold any custom passwords. Have any weird services that requires a specific length and/or forbidden characters Spectre does? Good luck, Spectre can’t help you here either. It’s not a password manager.
I think they are only talking about your username, not your actual name.
That is something I immediately thought about, there is no way to change a single password. All or nothing.
Good luck with hundreds of passwords that would need changing.
Nevermind. They are looking at your real name after all.
In practice it can be anything though. It just gets thrown in one of the hashing functions. They way they describe it:
user-key = SCRYPT( user-name, user-secret )site-key = HMAC-SHA-256( site-name . site-counter, user-key )site-password = PW( site-template, site-key )Which is kinda interesting, they mention site-counter and site-template. The counter indicates you can set it to a different value to get a different password for that site. But then obviously every time you want to recall that password, you have to set the site counter correctly. I guess the app will remember this, but the web version obviously doesn’t. But the gimmick is that it doesn’t store anything, but it seems for the app to work it does need to store the settings to generate your password.
And also there is a site-template, which seems to hold various ways to generate passwords. Long, medium, short, pin, etc etc. With or without special symbols. It even mentions ‘saved personal password’ so I guess it can save custom passwords? Hopefully encrypted though.
That sorta addresses the concerns I have. But obviously that means you need the app, the website doesn’t do all those extra things. And if you loose the app you loose your custom site counter and template.
Also, the CLI version seems to happily store the username and secret on your pc? Or at least lets you read it from a file, so…
(I haven’t actually used the app, just going through some docs and source code here)
If one password is leaked, it should let you change the key for just that one service. Eventually, you could have a bunch of different keys for different service. But then you will need some manager for remembering all those different secrets. Yay!
I see they have a counter that maybe you can set? Then I guess you just need a manager to store the counters, which seems fundamentally the same
See my response a few comments down this thread. I found the counter and password-template too. I don’t have an iphone so I can’t test the app, but I very much think this app stores the ‘settings’ (counter, template) to generate the password. Based on what the api and CLI can do… it has to, surely. It also has the ability to retrieve a custom password.
Of course the webapp in the link doesn’t do all of that. You’re stuck with 1 password in 1 format. Unless you change your secret and then all your passwords change.