I understand the rough idea that a password manager stores encrypted data, but there is one part I cannot make intuitive.
When I type the master password, the manager can suddenly reveal all the individual passwords. Yet the websites I log into only receive their own password, not the master password.
Is the simplest explanation that the master password is used locally to derive a key that unlocks the vault, and the website never participates in that step at all? I am mainly trying to understand where the “trust boundary” is rather than the exact cryptography.
1 reply
The “locally derive a key” idea is the simplest way to think about it, yes. I like that model because it keeps the browser, the website, and...
The “locally derive a key” idea is the simplest way to think about it, yes. I like that model because it keeps the browser, the website, and the vault in separate boxes in my head.
That separation is what finally clicked for me too. The websites only see their own door key, not the key to the whole house.
2 replies
The funny part is how many people imagine the password manager as politely asking the internet for permission. It’s really more like a locke...
The funny part is how many people imagine the password manager as politely asking the internet for permission. It’s really more like a locked box on your desk than a middleman in the cloud, at least in the simple case.
Is there ever a moment where the website learns anything about the master password indirectly, or is that just not part of the flow at all?
Not from the normal login flow. The website only gets the account password, though of course the provider of the password manager could matt...
1 reply
Yes, that’s the basic trust boundary. Your master password unlocks something locally, and the websites never need to see it.
Yes, that’s the basic trust boundary. Your master password unlocks something locally, and the websites never need to see it.
That was the missing picture for me too. The manager is basically doing the private part on your device and only handing over the site password when you need it.