4 ms·

I've been wondering is there any disadvantage in using password hashers (either as plugins like [0] or standalone) for generating safe passwords? It seems like

by dr_hooo 10y ago

I've been wondering is there any disadvantage in using password hashers (either as plugins like [0] or standalone) for generating safe passwords? It seems like a great idea to me, yet most people here seems to be prefer full blown PW manager apps or even online services for this. Am I missing something? [0] https://chrome.google.com/webstore/detail/password-hasher-plus-pass/glopbmohkffbnplcjbbbfmmimfhfnhgd?hl=en https://chrome.google.com/webstore/detail/password-hasher-pl...

gliptic 10y ago
The main problems I find with hashers are: * No way to change password without storing things * No way to handle site-specific rules without storing things * No way to store auxiliary data (URLs, usernames, etc.) * No way to see which sites you have accounts on
- dr_hooo 10y ago
  Makes sense, from a usability PoV, thanks.
netheril96 10y ago
Because it also needs to store a database. No reduced complexity at all.
- dr_hooo 10y ago
  In its most basic form it just requires a key file and an algorithm. But I agree that more complex operations need some DB.
tscs37 10y ago
I consider them more insecure than a reasonably well made password manager, all that is between you and any possible site you will ever register on or have registered on, is a master password. On the other hand, I can change my Lastpass/Keepass password regularly, denying a cracker access to my accounts in the future. The security of any password manager, including hashers, is not only how secure it is against attacks, but how secure it is after it has been successfully attacked and how easy it is to recover full security without losing too much data.
TorKlingberg 10y ago
Here is a writeup: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...

4 ms·

I've been wondering is there any disadvantage in using password hashers (either as plugins like [0] or standalone) for generating safe passwords? It seems like

by dr_hooo 10y ago

gliptic 10y ago
The main problems I find with hashers are: * No way to change password without storing things * No way to handle site-specific rules without storing things * No way to store auxiliary data (URLs, usernames, etc.) * No way to see which sites you have accounts on
- dr_hooo 10y ago
  Makes sense, from a usability PoV, thanks.
netheril96 10y ago
Because it also needs to store a database. No reduced complexity at all.
- dr_hooo 10y ago
  In its most basic form it just requires a key file and an algorithm. But I agree that more complex operations need some DB.
tscs37 10y ago
I consider them more insecure than a reasonably well made password manager, all that is between you and any possible site you will ever register on or have registered on, is a master password. On the other hand, I can change my Lastpass/Keepass password regularly, denying a cracker access to my accounts in the future. The security of any password manager, including hashers, is not only how secure it is against attacks, but how secure it is after it has been successfully attacked and how easy it is to recover full security without losing too much data.
TorKlingberg 10y ago
Here is a writeup: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...