6 ms·
I don't have the time to figure out how it works, but I bet it uses the same principle that I presented about 3 years ago (basically there is a "master password
by gtrubetskoy 10y ago
I don't have the time to figure out how it works, but I bet it uses the same principle that I presented about 3 years ago (basically there is a "master password"):
http://grisha.org/blog/2013/05/31/simple-solution-to-password-reuse/ http://grisha.org/blog/2013/05/31/simple-solution-to-passwor...
- sixhobbits 10y agoConsidering the part I quoted literally includes the phrase "based on a master password", you could probably have taken the time to 'figure out how it works' ;)
- gtrubetskoy 10y agoLol - that's what happens when posting on a Monday before finishing the morning coffee. Someone commented on my article then that you can pretty much accomplish this from the command line with: > echo "masterpassword gmail" | md5 (Ignoring the implication of the password potentially getting logged in shell history, of course.)
- austinjp 10y agoMaybe try just > md5sum | cut -d" " -f1 or similar. Carriage-return followed by ctrl-D to exit. Output matches echo "whatever" | md5sum | cut -d" " -f1 in my term.
- palant 10y agoYou better add a huge "do not use" warning to that blog post. Deriving passwords via SHA-512 or similar is a very common mistake and makes guessing your master password way too easy. I outlined the details in my blog post here: https://palant.de/2016/04/20/security-considerations-for-password-generators https://palant.de/2016/04/20/security-considerations-for-pas... No, LessPass uses PBKDF2 which is already a lot better than merely SHA-512. However, with 8192 iterations it still makes guessing the master password too easy.