So I’m using bit warden self hosted and now I’m freaking out about the very real possibility of my passwords getting stolen or lost in a fire. Having passwords on my phone makes no sense.

We need some sort of distributed password manager safety net. Like I keep your passwords safe if you keep mine. But how can I trust you? Can you trust me?

  • litchralee@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    1
    ·
    edit-2
    1 day ago

    For a single password, it is indeed illogical to distribute it to others, in order to prevent it from being stolen and misused.

    That said, the concept of distributing authority amongst others is quite sound. Instead of each owner having the whole secret, they only have a portion of it, and a majority of owners need to agree in order to combine their parts and use the secret. Rather than passwords, it’s typically used for cryptographically signing off on something’s authenticity (eg software updates), where it’s known as threshold signatures:

    Imagine for a moment, instead of having 1 secret key, you have 7 secret keys, of which 4 are required to cooperate in the FROST protocol to produce a signature for a given message. You can replace these numbers with some integer t (instead of 4) out of n (instead of 7).

    This signature is valid for a single public key.

    If fewer than t participants are dishonest, the entire protocol is secure.

    • blitzen@lemmy.ca
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      21 hours ago

      I remember learning about Shamir’s secret sharing, and indeed the concept is fascinating. I’m not sure passwords is the best use case of something like that, but I’m not completely against it in theory.