4 ms·

I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... I have personally have found bliss in Password Hasher Plus (ht

I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... I have personally have found bliss in Password Hasher Plus (https://chrome.google.com/webstore/detail/password-hasher-plus-pass/glopbmohkffbnplcjbbbfmmimfhfnhgd https://chrome.google.com/webstore/detail/password-hasher-pl...) (Hash it! App on android) Basically it hashes your password together with the domain name you want to login in together with a very long private key to generate an arbitrarily long password as a final pass. The chrome extension and app provide some nice utilities to make all this pretty easy and transparent to use. Advantages: * Only one password to remember. * Different final passwords for all services * Hashed with a unique private key * Arbitrarily generate any pasdword length you want * Passwords are not shared with anyone (automatically generated on your device) * Plus many more (that i will do a bad job describing) Disadvantages: * More of a script approach not a full blown application (matters to some) * Different approach for desktop and mobile (extension vs app)

ZoFreX 10y ago
> I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... 1) Many password managers are designed specifically to survive the website being owned. I use LastPass and I'm not sharing my passwords with them, I'm sharing my encrypted passwords with them. It's an important consideration! 2) You don't want to trust a third party so you use a Chrome extension that is made by a third party and has permission to access any website? You are trusting a third party.
- stratosgear 10y ago
  Well, I know exactly what goes in the Chrome extension (https://github.com/ericwoodruff/passwordhasherplus https://github.com/ericwoodruff/passwordhasherplus) or the android app (https://github.com/ginkel/hashit https://github.com/ginkel/hashit) The point is that I do NOT want to store (even hashed) passwords with a third party in the hopes that they will be able to protect my passwords, when I can generate them on the spot from the device I'm using. But that's just me. My post was just a comment on how people find third party password managers so secure. I can't be the only paranoid about this...
  - ZoFreX 10y ago
    Obviously there's a trade-off between security and convenience here, and that's a very personal choice to everyone, so I'm not going to argue that part of things with you. I do have to point out a couple of things though. Password managers don't store "hashed" passwords with a third party - they store encrypted ones. I also wouldn't personally use the phrase "in the hopes that they will be able to protect my passwords" - I don't rely on LastPass protecting squat. If their entire database leaked, my passwords are still safe. I think that element of the design is very important and wouldn't use a system where hope was required! You certainly aren't the only paranoid one and lots of people on HN seem pretty wary of password managers :)
- chiefalchemist 10y ago
  Another option is to store your full PW and/or user name. For example, add a +++ to every pw but don't store that bit in the PWM. If nothing else, it makes things that much less obvious
  - ZoFreX 10y ago
    My key criteria for any password method is "what if everyone uses it?". If a major PWM fails, and lots of people did something like this, you can bet your boots that password crackers would give it a go and retrieve your real password.

ZoFreX 10y ago

> I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... 1) Many password managers are designed specifically to survive the website being owned. I use LastPass and I'm not sharing my passwords with them, I'm sharing my encrypted passwords with them. It's an important consideration! 2) You don't want to trust a third party so you use a Chrome extension that is made by a third party and has permission to access any website? You are trusting a third party.

stratosgear 10y ago
Well, I know exactly what goes in the Chrome extension (https://github.com/ericwoodruff/passwordhasherplus https://github.com/ericwoodruff/passwordhasherplus) or the android app (https://github.com/ginkel/hashit https://github.com/ginkel/hashit) The point is that I do NOT want to store (even hashed) passwords with a third party in the hopes that they will be able to protect my passwords, when I can generate them on the spot from the device I'm using. But that's just me. My post was just a comment on how people find third party password managers so secure. I can't be the only paranoid about this...
- ZoFreX 10y ago
  Obviously there's a trade-off between security and convenience here, and that's a very personal choice to everyone, so I'm not going to argue that part of things with you. I do have to point out a couple of things though. Password managers don't store "hashed" passwords with a third party - they store encrypted ones. I also wouldn't personally use the phrase "in the hopes that they will be able to protect my passwords" - I don't rely on LastPass protecting squat. If their entire database leaked, my passwords are still safe. I think that element of the design is very important and wouldn't use a system where hope was required! You certainly aren't the only paranoid one and lots of people on HN seem pretty wary of password managers :)
chiefalchemist 10y ago
Another option is to store your full PW and/or user name. For example, add a +++ to every pw but don't store that bit in the PWM. If nothing else, it makes things that much less obvious
- ZoFreX 10y ago
  My key criteria for any password method is "what if everyone uses it?". If a major PWM fails, and lots of people did something like this, you can bet your boots that password crackers would give it a go and retrieve your real password.