5 ms·
Note that the algorithm used by pwdhash is very weak. It uses just one round of 1 round of HMAC-MD5. Not even a slow hash function. See https://github.com/dann
by dannysu 9y ago
Note that the algorithm used by pwdhash is very weak. It uses just one round of 1 round of HMAC-MD5. Not even a slow hash function.
See https://github.com/dannysu/hash0 https://github.com/dannysu/hash0 for comparison of other similar sites that all have the same flaw and the reason I coded hash0 (no longer maintained though).
- Leftium 9y agoI've considered making a version of PwdHash that uses a stronger hash function (and I think my brother did make one)... But to be honest, if a hacker specifically targets you, you will probably be compromised, no matter how strong a hash function you use. (They will probably just use one of the many other attack vectors.) And there's that joke about two guys running from a bear. "I don't have to outrun the bear; I just have to outrun you" PwdHash lets me have unique, non-trivial passwords for every site with minimal fuss. There will be probably lots of lower hanging fruit before hackers start targeting PwdHash-generated passwords.