{"action":"closed","issue":{"url":"https://api.github.com/repos/chriszarate/supergenpass/issues/67","labels_url":"https://api.github.com/repos/chriszarate/supergenpass/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/chriszarate/supergenpass/issues/67/comments","events_url":"https://api.github.com/repos/chriszarate/supergenpass/issues/67/events","html_url":"https://github.com/chriszarate/supergenpass/issues/67","id":74773626,"number":67,"title":"Master Password + Secret","user":{"login":"mrmachine","id":51939,"avatar_url":"https://avatars.githubusercontent.com/u/51939?v=3","gravatar_id":"","url":"https://api.github.com/users/mrmachine","html_url":"https://github.com/mrmachine","followers_url":"https://api.github.com/users/mrmachine/followers","following_url":"https://api.github.com/users/mrmachine/following{/other_user}","gists_url":"https://api.github.com/users/mrmachine/gists{/gist_id}","starred_url":"https://api.github.com/users/mrmachine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrmachine/subscriptions","organizations_url":"https://api.github.com/users/mrmachine/orgs","repos_url":"https://api.github.com/users/mrmachine/repos","events_url":"https://api.github.com/users/mrmachine/events{/privacy}","received_events_url":"https://api.github.com/users/mrmachine/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-05-09T22:31:08Z","updated_at":"2015-11-19T04:20:40Z","closed_at":"2015-11-19T04:20:40Z","body":"If you have strong secret (say a randomly generated 50 character string), is it still necessary to have a strong master password? Or would a shorter password that is quicker to type (say 8 random characters) be sufficient?\r\n\r\nI think it was mentioned that if an attacker has local access to the machine you have to assume the secret is compromised, but if they already have local access you might already have bigger problems?\r\n\r\nDoes having a long random secret with a short master password still provide great protection against remote brute force attacks if one of your sites is compromised and the attacker has your hashed password?\r\n"}}