4 ms·
You just exposed all your passwords to bruteforcing attacks. Unless “hash” in this case is something like scrypt with sane parameters. Originally (before I sta
by palant 4y ago
You just exposed all your passwords to bruteforcing attacks. Unless “hash” in this case is something like scrypt with sane parameters.
Originally (before I started writing my own password manager) I also thought that this is a safe method of password generation. And then I realized that it isn’t. Wrote about it here: https://palant.info/2016/04/20/security-considerations-for-password-generators/ https://palant.info/2016/04/20/security-considerations-for-p...
- edflsafoiewq 4y agoAssuming you have the password and key, you'd need to brute force hash and masterPasswd. Seems hard.
- palant 4y agoIt isn’t. You certainly used MD5, SHA1, SHA256 or SHA512 as hash, with SHA256 being the most likely one. All of these are very easy to bruteforce – if someone has one of your passwords, bruteforcing your master password won’t take all too long.
- edflsafoiewq 4y agohash(x+const), hash^n(x), etc. are also hash functions.