3 ms·

I've actually been using this approach for the past 12 years. There used to be an old firefox plugin called Password Composer (http://web.archive.org/web/*/http

I've actually been using this approach for the past 12 years. There used to be an old firefox plugin called Password Composer (http://web.archive.org/web/*/http://jlpoutre.home.xs4all.nl/BoT/Javascript/PasswordComposer/password_composer_form.html http://web.archive.org/web/*/http://jlpoutre.home.xs4all.nl/...) which would let you type in your master password into firefox, append the website domain, take a digest of the result and truncate to 8 characters before sending to the website. Over the years, I replaced this plugin with a simple 5-line script so I can reproduce my passwords from anywhere, strengthened the hash function from SHA-1 to bcrypt, and also added a configurable password length so I can gradually grow passwords over time as computers grow more powerful. Here's my solution: http://akkartik.name/pc http://akkartik.name/pc Regarding other comments in this thread about managing exceptions to the scheme over time, I have a simple solution: I let my browser save my passwords. I think this is a reasonable trade-off; the dominant threat online today is not somebody gaining physical access to your devices, but random script kiddies brute-forcing passwords using stolen hashes. Tl;dr - use my script to generate passwords, use your browser to remember passwords, and the complexity is quite manageable. Edit - sorry, I forgot that that 5-line script calls another 5-line script: http://akkartik.name/bcrypt_digest http://akkartik.name/bcrypt_digest. One potential gotcha I realized recently is that it uses the bcrypt encryption scheme rather than the well-known digesting algorithm. The two share a common kernel, from what I can tell, though there are significant differences. There might by cryptographic implications to using an encryption scheme for digesting; I'm not an expert. Hopefully the fact that this is a bespoke arrangement being used by a tiny population will keep anyone from hacking me :)

pavel_lishin 11y ago
If you're storing your passwords in the browser anyway, why not just generate random, arbitrary passwords anyway?
- akkartik 11y ago
  It gives me a way to figure out my password on a strange system. Admittedly this use case is growing less common with the ubiquity of personal devices and sync.
  - a3n 11y ago
    So as your browser stored passwords pass through (and rest at) the server, waiting to be synced to another browser or device, you have passwords "up there." Are they in the clear? Are the encrypted well enough?
    - akkartik 11y ago
      https://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... Your point is well-taken that I'm just replacing one external service with another, so the difference isn't large enough to convince anyone to switch. My original response in this thread was just to point out prior work relevant to the brainstorming above.

pavel_lishin 11y ago

If you're storing your passwords in the browser anyway, why not just generate random, arbitrary passwords anyway?

akkartik 11y ago
It gives me a way to figure out my password on a strange system. Admittedly this use case is growing less common with the ubiquity of personal devices and sync.
- a3n 11y ago
  So as your browser stored passwords pass through (and rest at) the server, waiting to be synced to another browser or device, you have passwords "up there." Are they in the clear? Are the encrypted well enough?
  - akkartik 11y ago
    https://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... Your point is well-taken that I'm just replacing one external service with another, so the difference isn't large enough to convince anyone to switch. My original response in this thread was just to point out prior work relevant to the brainstorming above.