4 ms·

SuperGenPass is a much better, simpler, and safer alternative, IMO. http://supergenpass.com http://supergenpass.com

bgraves 17y ago
Nice! This is pretty much exactly what I was looking for!
paulgb 17y ago
It constantly surprises me that supergenpass hasn't caught on more with geeks. It's a pretty elegant solution to a problem everyone has.
- theycallmemorty 17y ago
  Looks interesting but my first thought is that if I want to access my gmail on someone else's computer I would need to install the firefox extension first.
  - nuclear_eclipse 17y ago
    It's just a bookmarklet, not an extension, and if you're not at your own computer, there's a "mobile" version that can be used from anywhere to generate the correct password.
  - paulgb 17y ago
    I've memorized a few (non-genpass) passwords for sites that I regularly use from other computers -- gmail being one of them. I also use the mobile version which nuclear_eclipse mentioned.
gojomo 17y ago
By typing the master password into the destination form, then replacing it, the master is potentially revealed to any target site that might use JS/AJAX to view the password before form submission. So, this is not helpful against the "one bad (or compromised) site steals my master password" threat. If SuperGenPass were to pop its own window, calculate the site-specific complex password, then insert that into the form, it could probably be safe -- but would still need very careful design. (Once a bookmarklet starts interacting with a page, it might reveal its internal state to that page.)
- nuclear_eclipse 17y ago
  Yes, that is still a threat, and I would love to see SGP's algorithm make it into native addons for Firefox, Chrome, etc, triggered by a hotkey or toolbar button. However, my initial attempt fell flat when trying to wade through XUL, just didn't have enough time... And if you're really that worried about a new site, the mobile version can be saved to your local disk and opened in a separate tab, and then copy-paste the generated password into the site in question.
- grogers 17y ago
  You can always use the mobile version which IS a separate webpage that you type the domain and your password into and it generates your password (which you copy paste). http://supergenpass.com/mobile/ http://supergenpass.com/mobile/ Although this still requires that you trust supergenpass.com to not change the javascript it is serving you into something malicious.
Periodic 17y ago
I've been using PwdHash. It's basically the same thing, but it's a Firefox addon. It will automatically hash a password field with the domain if you start the password with "@@" or hit F2. It also has a bunch of guards to warn you if you're entering your password in a field that might be insecure. https://www.pwdhash.com/ https://www.pwdhash.com/
philfreo 17y ago
1Password is quite good for the Mac: http://agilewebsolutions.com/products/1Password http://agilewebsolutions.com/products/1Password It integrates well with Firefox & Safari, and will sync over wi-fi to an iPhone for an encrypted backup.
durana 17y ago
For Chrome users there's http://code.google.com/p/superchromepass/ http://code.google.com/p/superchromepass/
gfxmonk 17y ago
If you're worried about browser security, there's a command-line reimplementation in python that a friend and I wrote: http://github.com/gfxmonk/supergenpass http://github.com/gfxmonk/supergenpass Less convenient, but much less likely to leak your passwords via the browser...

Nice! This is pretty much exactly what I was looking for!

It constantly surprises me that supergenpass hasn't caught on more with geeks. It's a pretty elegant solution to a problem everyone has.

theycallmemorty 17y ago
Looks interesting but my first thought is that if I want to access my gmail on someone else's computer I would need to install the firefox extension first.
- nuclear_eclipse 17y ago
  It's just a bookmarklet, not an extension, and if you're not at your own computer, there's a "mobile" version that can be used from anywhere to generate the correct password.
- paulgb 17y ago
  I've memorized a few (non-genpass) passwords for sites that I regularly use from other computers -- gmail being one of them. I also use the mobile version which nuclear_eclipse mentioned.

gojomo 17y ago

By typing the master password into the destination form, then replacing it, the master is potentially revealed to any target site that might use JS/AJAX to view the password before form submission. So, this is not helpful against the "one bad (or compromised) site steals my master password" threat. If SuperGenPass were to pop its own window, calculate the site-specific complex password, then insert that into the form, it could probably be safe -- but would still need very careful design. (Once a bookmarklet starts interacting with a page, it might reveal its internal state to that page.)

nuclear_eclipse 17y ago
Yes, that is still a threat, and I would love to see SGP's algorithm make it into native addons for Firefox, Chrome, etc, triggered by a hotkey or toolbar button. However, my initial attempt fell flat when trying to wade through XUL, just didn't have enough time... And if you're really that worried about a new site, the mobile version can be saved to your local disk and opened in a separate tab, and then copy-paste the generated password into the site in question.
grogers 17y ago
You can always use the mobile version which IS a separate webpage that you type the domain and your password into and it generates your password (which you copy paste). http://supergenpass.com/mobile/ http://supergenpass.com/mobile/ Although this still requires that you trust supergenpass.com to not change the javascript it is serving you into something malicious.

Periodic 17y ago

I've been using PwdHash. It's basically the same thing, but it's a Firefox addon. It will automatically hash a password field with the domain if you start the password with "@@" or hit F2. It also has a bunch of guards to warn you if you're entering your password in a field that might be insecure. https://www.pwdhash.com/ https://www.pwdhash.com/

philfreo 17y ago

1Password is quite good for the Mac: http://agilewebsolutions.com/products/1Password http://agilewebsolutions.com/products/1Password It integrates well with Firefox & Safari, and will sync over wi-fi to an iPhone for an encrypted backup.

durana 17y ago

For Chrome users there's http://code.google.com/p/superchromepass/ http://code.google.com/p/superchromepass/

gfxmonk 17y ago

If you're worried about browser security, there's a command-line reimplementation in python that a friend and I wrote: http://github.com/gfxmonk/supergenpass http://github.com/gfxmonk/supergenpass Less convenient, but much less likely to leak your passwords via the browser...