Next.js Hacker News
Show HN: Paasword – a password vault that never stores your passwords
2 points by yoyo250 2 days ago | 2 comments
  • zahlman
    > a physical OpenPGP key (smartcard/YubiKey)

    I don't know how you get a reproducible value from this, but in the use described it isn't actually contributing a second factor.

    • yoyo250
      You're right — it's not a true "second factor" in the 2FA sense.

      The idea is to bind password derivation to a physical OpenPGP key.

      Without the smartcard/YubiKey inserted, the program can't generate the same password, even if someone knows the domain/username/phrase.

      So the key isn't used as extra entropy, but as an essential part of the derivation process.