17 ms·
I've been using a similar scheme but without a database. Just a bcrypt hash of my password using the website/systems name as a salt, and then formatted accordin
by qixxiq 15y ago
I've been using a similar scheme but without a database. Just a bcrypt hash of my password using the website/systems name as a salt, and then formatted according to an alphanumeric alphabet with symbols.
It also has support for sub passwords (such as "work/twitter") where it simply generates the "work" password and uses that to generate the twitter password. That way I can give the work password to anyone who needs it and they can get into twitter/etc, while not needing to remember it myself.
This is useful because I can upload the password generator to a website, along with keeping copies on my phone and pc.
I'd be interested in knowing the cryptographic security of this scheme, but I'd assume its pretty good.
- drdaeman 15y agoThis gets problematic when you encounter a site which dislikes your generated password. It just tells that the password is either too long or complex ("N chars max or can't contain '/' character"), or too short or simple ("must contain numbers", and this exact generated one didn't). Handling such exceptions is somehow unpleasant.