3 ms·

Why not use a base64 encoded sha1 hash of your password salted with the web address like this: #!/bin/sh #usage: webpass.sh <website> website=$1

by sprash 11y ago

Why not use a base64 encoded sha1 hash of your password salted with the web address like this: #!/bin/sh #usage: webpass.sh <website> website=$1 stty -echo read -p "Password: " password echo stty echo echo -n "$website" | openssl sha1 -hmac "$password" | cut -d" " -f2 | xxd -r -p | base64 | tr -d -c "[:alnum:]" echo At least this is somewhat cryptographically secure.

fredley 11y ago
This suffers from the same problem as the article's algorithm: it is fine until you need to change one of your passwords. Say a site gets compromised, or for whatever reason you need to change your password. Now what? You need to change all your passwords in order to be able to use this method, or you need to remember one different password, or remember that you need to do <website>.2 or something. Either way, you're back to relying on memory.
- sprash 11y ago
  > it is fine until you need to change one of your passwords For me, this happens less often than once a year. And then it is a good idea to change all passwords anyway. The alternative is to store passwords somewhere in a password manager. However if this storage gets somehow lost/compromised ALL of your passwords get lost/compromised.
  - crazygringo 11y ago
    I had my mail account "suspect" a compromise 4 times in 2 months (no idea what triggered it) and forced me to change my password 4 times.
dwenzek 11y ago
I use this public javascript: http://venge.net/programs/twonz.html http://venge.net/programs/twonz.html. To deal with changed passwords and password restrictions, I use a page with of mapping for each issue to an updated base url or changes to be applied to the forged password.
burkaman 11y ago
Because your bank probably limits you to 10 characters or something, and your insurance company requires at least one special character, and now you have to remember a bunch of special cases and you start wanting a password manager again.

by sprash 11y ago

fredley 11y ago

This suffers from the same problem as the article's algorithm: it is fine until you need to change one of your passwords. Say a site gets compromised, or for whatever reason you need to change your password. Now what? You need to change all your passwords in order to be able to use this method, or you need to remember one different password, or remember that you need to do <website>.2 or something. Either way, you're back to relying on memory.

sprash 11y ago
> it is fine until you need to change one of your passwords For me, this happens less often than once a year. And then it is a good idea to change all passwords anyway. The alternative is to store passwords somewhere in a password manager. However if this storage gets somehow lost/compromised ALL of your passwords get lost/compromised.
- crazygringo 11y ago
  I had my mail account "suspect" a compromise 4 times in 2 months (no idea what triggered it) and forced me to change my password 4 times.

dwenzek 11y ago

I use this public javascript: http://venge.net/programs/twonz.html http://venge.net/programs/twonz.html. To deal with changed passwords and password restrictions, I use a page with of mapping for each issue to an updated base url or changes to be applied to the forged password.

burkaman 11y ago

Because your bank probably limits you to 10 characters or something, and your insurance company requires at least one special character, and now you have to remember a bunch of special cases and you start wanting a password manager again.