What are the pros and cons of deterministic site-specific password generation from a master pass? I've been reading up a bit on deterministic password generators. All the ones I can find basically do something like this:


Pick a master username and a master passphrase. The username could be your email, or a PIN, or something else. The master passphrase can be subject to stringent requirements to ensure sufficient entropy. The combination of these two factors needs to be ultra-secure and something you're reasonably certain that nobody's ever used before.
Enter the site name that you want a password for.
Generate the string $H^n\text{(passphrase||username||sitename})$, where $H^n(\cdots)$ is an n-fold iteration of SHA256 or some other sufficiently secure hashing algorithm and $||$ is string concatenation.
Make sure that n is sufficiently large such that n iterations of the hash generates a substantial amount of work and protects against brute-forcing.
Do a final deterministic mapping from this last string down to an n-character string where the individual chars of the string are in some set of "valid" characters (alphanumeric, alphanumeric+symbols, etc).


There are variations on the above, but that seems to be the basic idea.

Now, I'm curious how secure and trustworthy an algorithm like this really is compared to existing password managers.

For existing password managers, you have the same basic weakness - if your user+master pass is compromised, all of your passwords are also compromised. But does this system have any additional weakness on top of that?

It seems as though it'd be fairly resistant to the obvious things:
- If your plaintext pass for one site is compromised, it'd be very difficult to work out your pass for another site.


Furthermore, due to the fact that the hash function is iterated a sufficient number of times, it'd be difficult to brute force.
The best way to attack this seems to be a rainbow table approach with a bunch of common master usernames, master passphrases, and site names, but so long as your username+passphrase is of sufficient entropy, that'd be difficult to pull off.
Furthermore, if you want extra security for a certain site, you can increase the entropy of the sitename field a bit (example: eBay becomes 3b4Y@!#$% or something).


Seems reasonably secure, but I don't know if I'm missing something. Is there some well-known weakness with this system?
The above scheme does have a very important drawback against schemes that encrypt a password store. If you randomly generate the site  specific passwords then there is no relation to the master password. You would need the complete password store to perform e.g. dictionary attacks to find the master password. This is not true for the deterministic password generator you've described; one single leaked site specific password would enable an attacker to launch an attack on the master password. In the following two paragraphs I'll focus on the security without regard of this observation.

It seems that the scheme above is just an application of a Password Based Key Derivation Scheme (PBKDF), coupled with a deterministic method of mapping the result to a new password in step 5. As long as step 5 only maps to an array of characters in a specific alphabet without loosing entropy, the security of the scheme depends on the PBKDF used. KDF's commonly already include parameters specific to the secret that is to be generated (in this case that would be the site name).

So for the security of the scheme you should simply study security of PBKDF's and - if possible - the security of the specific PBKDF that is being used. Maybe you can compare the scheme against well known variants like PBKDF1, PBKDF2, bcrypt, scrypt or e.g. the proprietary OpenSSL PBKDF.