4 ms·
Something like this? https://www.pwdhash.com/ https://www.pwdhash.com/ You can use the same password but the local browser plugin will use the site's URL to ha
by crcastle 15y ago
Something like this? https://www.pwdhash.com/ https://www.pwdhash.com/ You can use the same password but the local browser plugin will use the site's URL to hash the password you type into something unique to that URL. I haven't used it personally and haven't researched it in detail but I like the concept.
- mikey_p 15y agoSounds like supergenpass which was implemented in Javascript as a bookmarklet, which is pretty good idea, except that any website with malicious code could grab your master pass from the DOM, and then they could use that for your account on any other website. It looks like pwdhash works around this by functioning as a browser plugin (making your master password in accessible from the DOM) but I'd still be slightly worried about browser exploits allowing malicious sites to get at your master password.
- hammerdr 15y agoMaybe you use trust-level master passwords. E.g. Financial institutions you type in: 'myfinancialpassword' Other sites you type: 'myrelativelysecurepassword'
- Wilfred 15y agoIt's remarkably hard to get this right. pwdhash notes[1] that being a browser plugin stops JavaScript grabbing the password, but it's still possible with Flash. Third-party ports to other browsers don't even have the JS protection. pwdhash still leaks the length of the password since it aims to give users visual feedback of characters being typed. Then you've also got the issue of automatic update of plugins being compromised. The question is really: is it more secure than the alternatives? 1: http://crypto.stanford.edu/PwdHash/pwdhash.pdf http://crypto.stanford.edu/PwdHash/pwdhash.pdf