4 ms·

poor man's password manager: select one strong password that you are able to keep in mind. Then for every site you use, set the password to what is the output o

by antirez 16y ago

poor man's password manager: select one strong password that you are able to keep in mind. Then for every site you use, set the password to what is the output of: echo "strong_pass:sitename:strong_pass" | sha1sum Note: if you are using mac os x use "shasum" instead of "sha1sum". Make sure to don't expose your secure password of course. It's also a good idea to use a completely different strong password just for email. p.s. it's worth to note that since there are tons fo SHA implementations for Javascript it's possible to build all this as a web application where all the business happens in the client. The web app will just allow you to add a number of site names so that you don't have to type the site name by hand all the times. Btw the world would be a better place with all the auth cookies set to expire on 2036...

jules 16y ago
Why use the strong_pass twice?
- antirez 16y ago
  otherwise there are attacks possible with this simple schema. Check why it's a good idea to use an HMAC for serious applications instead of "secret:...mytext..." for more details (long story short, it's possible to continue the SHA1 computation resuming from where it ended and appending more text). It's really a problem in different cases, not in our case of generating passwords, but it's a good practice to use always HMAC or when it is not practical like in this case at least putting the secret before and after.
hammock 16y ago
This is a brilliant idea!
- bluger 16y ago
  Related - http://news.ycombinator.com/item?id=2000833 http://news.ycombinator.com/item?id=2000833
sjs 16y ago
Unfortunately some crappy site is going to thwart such an effort. "bzzz! you can only use 12 chars in your password" or "you have to use a symbol/uppercase letter" or some other lunacy. le sigh
- run4yourlives 16y ago
  And that site will more than likely be your bank to boot.
  - sjs 16y ago
    I have a feeling that some old bank software has fixed size fields and that's we get ridiculous maximum lengths on bank passwords.
gecko 16y ago
SuperGenPass (http://supergenpass.com/ http://supergenpass.com/) does that in a way that is more likely to generate strong passwords honored by sites (e.g., multiple cases, punctuation, etc.). It comes both as a bookmarklet, and, if you don't want to use that, a mobile version (http://supergenpass.com/mobile/ http://supergenpass.com/mobile/) that you can store somewhere safe so it doesn't even hit the internet (e.g., I store it on my Dropbox account so I can use it on my phone). Works great.
- nuclear_eclipse 16y ago
  There's also an extension for Chrome called SuperChromePass that allows you to generate your passwords outside of the DOM to prevent snooping, or use Ctrl-Shift-P to do in-DOM generation for convenience, depending on your preference and paranoia. That said, I've been using SGP/SCP for all my passwords for about a year now, and I have only come across a single site that wouldn't work with the default, 10 character password scheme: ConsumerReports.com All in all, I would definitely recommend this to everyone because it means you don't have to keep track of an encrypted password database or have any software installed on computers you use. If your computer crashes and you lose all your data, you just put SGP back on your bookmarks bar and carry on with life...
joh6nn 16y ago
this is already available for the major browsers as an extension; try googling for "pwd hash" (from stanford) and "password hasher". also, as was noted in another comment, this is currently being discussed in another thread
hieronymusN 16y ago
On a mac you might want to try cat /dev/urandom | openssl base64 | head -c 12; echo; Which can give you a nice random string.
- js2 16y ago
  openssl rand -hex 6 will give you 6 random bytes hex-encoded. Your specific command line can be done with: openssl rand -base64 9 | cut -c-12 Note, I think you wanted -c-12, not -c12.
tptacek 16y ago
This is not a great password manager function; the reason is, losing your sha1sum password gives the attacker enough information to mount a very, very fast brute force attack against "strong_pass" as long as they know the "sitename". A basic property of a password manager system should be that the loss of any password doesn't give attackers any information about other passwords; yours potentially concedes the "master secret" that animates all of them.

by antirez 16y ago

jules 16y ago

Why use the strong_pass twice?

antirez 16y ago
otherwise there are attacks possible with this simple schema. Check why it's a good idea to use an HMAC for serious applications instead of "secret:...mytext..." for more details (long story short, it's possible to continue the SHA1 computation resuming from where it ended and appending more text). It's really a problem in different cases, not in our case of generating passwords, but it's a good practice to use always HMAC or when it is not practical like in this case at least putting the secret before and after.

hammock 16y ago

This is a brilliant idea!

bluger 16y ago
Related - http://news.ycombinator.com/item?id=2000833 http://news.ycombinator.com/item?id=2000833

sjs 16y ago

Unfortunately some crappy site is going to thwart such an effort. "bzzz! you can only use 12 chars in your password" or "you have to use a symbol/uppercase letter" or some other lunacy. le sigh

run4yourlives 16y ago
And that site will more than likely be your bank to boot.
- sjs 16y ago
  I have a feeling that some old bank software has fixed size fields and that's we get ridiculous maximum lengths on bank passwords.

gecko 16y ago

SuperGenPass (http://supergenpass.com/ http://supergenpass.com/) does that in a way that is more likely to generate strong passwords honored by sites (e.g., multiple cases, punctuation, etc.). It comes both as a bookmarklet, and, if you don't want to use that, a mobile version (http://supergenpass.com/mobile/ http://supergenpass.com/mobile/) that you can store somewhere safe so it doesn't even hit the internet (e.g., I store it on my Dropbox account so I can use it on my phone). Works great.

nuclear_eclipse 16y ago
There's also an extension for Chrome called SuperChromePass that allows you to generate your passwords outside of the DOM to prevent snooping, or use Ctrl-Shift-P to do in-DOM generation for convenience, depending on your preference and paranoia. That said, I've been using SGP/SCP for all my passwords for about a year now, and I have only come across a single site that wouldn't work with the default, 10 character password scheme: ConsumerReports.com All in all, I would definitely recommend this to everyone because it means you don't have to keep track of an encrypted password database or have any software installed on computers you use. If your computer crashes and you lose all your data, you just put SGP back on your bookmarks bar and carry on with life...

joh6nn 16y ago

this is already available for the major browsers as an extension; try googling for "pwd hash" (from stanford) and "password hasher". also, as was noted in another comment, this is currently being discussed in another thread

hieronymusN 16y ago

On a mac you might want to try cat /dev/urandom | openssl base64 | head -c 12; echo; Which can give you a nice random string.

js2 16y ago
openssl rand -hex 6 will give you 6 random bytes hex-encoded. Your specific command line can be done with: openssl rand -base64 9 | cut -c-12 Note, I think you wanted -c-12, not -c12.

tptacek 16y ago

This is not a great password manager function; the reason is, losing your sha1sum password gives the attacker enough information to mount a very, very fast brute force attack against "strong_pass" as long as they know the "sitename". A basic property of a password manager system should be that the loss of any password doesn't give attackers any information about other passwords; yours potentially concedes the "master secret" that animates all of them.