3 ms·
They can't. Prove me otherwise. Even if they have plaintext password (which is often not case), this is just shasum. Feel free to guess which password (and whi
by rdslw 9y ago
They can't. Prove me otherwise.
Even if they have plaintext password (which is often not case), this is just shasum. Feel free to guess which password (and which exactly scheme) I used to generate my password for news.ycombinator.com, if (of course it's now not like that :) it is:
bb05f766a74e6bf722136eaca97d9beb1fcc8f59d47c2d9e6eb1667d57c4cb82
You have now (after hacking whole hackernews db) access to my password ONLY for the hackersnews. Which was the original goal of the method: to use different passwords at different sites, which if compromised (password), do not reveal scheme used to generate it for different sites.
- danieldk 9y agobb05f766a74e6bf722136eaca97d9beb1fcc8f59d47c2d9e6eb1667d57c4cb82 That's not the point. The malware would have access to your complete machine, possibly with root privileges, what holds them from reading your master password with a keylogger when you type it in? It does not provide more security against trojans than a password manager.
- rdslw 9y agoYou didnt read my reply nor the parent thread. I was replying solely and only to the acusation that after revealing plain text password on one site (which was generated using said scheme) you disclose every one. This is simply not true. In addition (but I didnt address that), there is no single keychain/password store to steal by the trojan. I can use it anywhere, using only my head as a 'storage' machine.