Flaws in deterministic password managers
I&#x27;ve been surprised by how negative the opinions of deterministic password managers have been since I&#x27;ve been using one for over two years and it has been a much better experience overall than using KeePass on Dropbox, and I also think that it&#x27;s more secure than cloud-based systems (see point 4).<p>My take on the points in the post:<p>1. Out of the 100 or so sites that I use, only a few have password policies that require tweaks, and it usually just requires disabling symbols and or adjusting the length. These tweaks are cached in my browser, so this hasn&#x27;t been much of an inconvenience.<p>2. My passwords are rarely revoked, and when they are it is just a counter bump. This is state, but again it is cached in the browser.<p>3. It&#x27;s true that they can&#x27;t store existing secrets, but this can be viewed as out of scope for a password manager.<p>4. For the application I use, it&#x27;s not true that exposing just the master password exposes all of your site passwords. There is a 512bit private key that is synchronized once between devices using a QR code. An attacker would need both the master password and the private key file to generate any passwords. Because the private key only exists on devices I physically own, this should be harder to obtain than an encrypted database that lives in the cloud, so I view this system as more secure than KeePass on Dropbox, Lastpass, or 1Password.<p>My experience over the past two years has been that the advantages are more significant than the disadvantages.