3 ms·

Like many who got bitten by Gawker, Sony, Mt.Gox and whoever else, I researched better alternatives. I found these options for password management utilities:

by shazow 15y ago

Like many who got bitten by Gawker, Sony, Mt.Gox and whoever else, I researched better alternatives. I found these options for password management utilities: - 1Password - KeePass - LastPass - PasswordGorilla - pwgen - pwsafe - SuperGenPassword Here's my summary and comparison between the alternatives: https://github.com/shazow/everything/blob/master/research/password-management-utilities.md https://github.com/shazow/everything/blob/master/research/pa...

abrowne 15y ago
Nice summary. I wish I had seen it about a month ago when I spent an afternoon hunting through comments here and elsewhere looking for alternatives to 1Password. (No Linux or WebOS is my main issue.) I see that you're using SuperGenPass. I loved and used the SGP bookmarklet for a while, but stopped when I read this article: "SuperGenPass is not that secure"[1]. Read the article, try the demo, then STOP USING THE BOOKMARKLET! Because of how the bookmarklet interacts with the page DOM, other scripts can read your password! Now this doens't mean you have to stop using SGP. I still use it, mostly with the excellent Chrome extension (SuperGenPass for Google Chrome™ by Denis[2]) or the SPG mobile page[3] (which can be saved for offline use). Both of these compute the password without interacting with any other pages. [1]: http://akibjorklund.com/2009/supergenpass-is-not-that-secure http://akibjorklund.com/2009/supergenpass-is-not-that-secure [2]: https://chrome.google.com/webstore/detail/bmmmhbgdbpnbfefmacdlbpfgegcibkjo https://chrome.google.com/webstore/detail/bmmmhbgdbpnbfefmac... [3]: http://supergenpass.com/mobile/ http://supergenpass.com/mobile/ [edited: typo, link formatting]
- shazow 15y ago
  Thanks! I agree, there are a few issues with SGP I would fix: It fails badly on Change Password forms, it uses ~10-iteration MD5 hashes which are easily-reversible today, and the default character set for the generated passwords is not great. I feel I'm still in the "research" stage where I want to see if I can survive with using something like SGP. I'll definitely switch over to the extension from now, though. Side note: It's probably not a terrible idea to still maintain multiple master passwords for really-important vs throw-away accounts.

by shazow 15y ago

abrowne 15y ago

Nice summary. I wish I had seen it about a month ago when I spent an afternoon hunting through comments here and elsewhere looking for alternatives to 1Password. (No Linux or WebOS is my main issue.) I see that you're using SuperGenPass. I loved and used the SGP bookmarklet for a while, but stopped when I read this article: "SuperGenPass is not that secure"[1]. Read the article, try the demo, then STOP USING THE BOOKMARKLET! Because of how the bookmarklet interacts with the page DOM, other scripts can read your password! Now this doens't mean you have to stop using SGP. I still use it, mostly with the excellent Chrome extension (SuperGenPass for Google Chrome™ by Denis[2]) or the SPG mobile page[3] (which can be saved for offline use). Both of these compute the password without interacting with any other pages. [1]: http://akibjorklund.com/2009/supergenpass-is-not-that-secure http://akibjorklund.com/2009/supergenpass-is-not-that-secure [2]: https://chrome.google.com/webstore/detail/bmmmhbgdbpnbfefmacdlbpfgegcibkjo https://chrome.google.com/webstore/detail/bmmmhbgdbpnbfefmac... [3]: http://supergenpass.com/mobile/ http://supergenpass.com/mobile/ [edited: typo, link formatting]

shazow 15y ago
Thanks! I agree, there are a few issues with SGP I would fix: It fails badly on Change Password forms, it uses ~10-iteration MD5 hashes which are easily-reversible today, and the default character set for the generated passwords is not great. I feel I'm still in the "research" stage where I want to see if I can survive with using something like SGP. I'll definitely switch over to the extension from now, though. Side note: It's probably not a terrible idea to still maintain multiple master passwords for really-important vs throw-away accounts.