3 ms·

Source Code: https://github.com/pashword/pashword https://github.com/pashword/pashword I built this webapp a few months ago because I forgot my bank account pa

Source Code: https://github.com/pashword/pashword https://github.com/pashword/pashword I built this webapp a few months ago because I forgot my bank account password and got locked out. A few days later, my friend complained to me about the same problem, he forgot his password and couldn't login. This was a fun way to learn more about cryptography and hashing in detail and it was a lot of fun creating something that I would personally use. I am well aware of the pitfalls and shortcomings of using such a tool but to be honest, I like Pashword because it suits my threat model and it's very convenient for me to use as well. Would love to know what HN thinks about it and if there's anything I could do to improve it as well :)

rkagerer 4y ago
And when the website forces you to rotate your password? Will you have facebook.com-2, facebook.com-3, etc?
- NayamAmarshe 4y ago
  That's one of the flaws. No way to really avoid this since Pashword is a hashing algorithm basically.
shudza 4y ago
I like it, many people use a single password for every website, this could keep them safer. Maybe make a browser extension?
- NayamAmarshe 4y ago
  Yes, I was working on a browser extension but got busy with work. I'll get back on it as soon as I get some time :)
throwanem 4y ago
Not so much on the technical side, but from a product perspective I can't get over how the name, when spoken aloud, sounds like it's had a couple drinks too many or maybe lost its upper denture plate.
tallanvor 4y ago
Other people have hit on some/all of these issues, but here's my list of why I would never consider using this, and would do everything I could to convince friends and family never to use it either: 1. If I have to change my password for any reason, I would have to come up with a new secret key since the site/username would never change. Suddenly I'm stuck having to remember multiple secret keys. 2. Poor control over the length of the passwords - you only provide 3 options, and 20 characters is pretty low. 3. You can't exclude certain certain characters - yes, it's stupid for companies to not allow certain characters in the password, but many sites still do so. 4. If I try to just put in an app name, you tell me to use a real URL. 5. It was SLOW. Maybe it's just busy, but I'd rather not have to generate the password every time. 6. Even people experienced in cryptography and hashing make mistakes. A product made by someone learning about them is... Suspect. A password manager is 100% the better choice every time. For the people in my life who don't want to learn how to use a password manager, then a notebook at their desk at home is the second best option.
- NayamAmarshe 4y ago
  > 1. If I have to change my password for any reason, I would have to come up with a new secret key since the site/username would never change. Suddenly I'm stuck having to remember multiple secret keys. Yep, just like you would with a normal password. Pashword is not a password manager replacement, it's just a helper for when you wanna generate strong passwords that you re-generate anytime. > 2. Poor control over the length of the passwords - you only provide 3 options, and 20 characters is pretty low. The point is to not remember the password length for each website, hence the 3 options. > You can't exclude certain certain characters - yes, it's stupid for companies to not allow certain characters in the password, but many sites still do so. You can, actually. Just press the 'Not working?' button :) > 4. If I try to just put in an app name, you tell me to use a real URL. Oh right, that's a valid point. I'll remove the domain requirement. > 5. It was SLOW. Maybe it's just busy, but I'd rather not have to generate the password every time. The algorithm is pretty computation heavy, to avoid brute force attacks even with ASICs. If you use Bromite, the privacy settings can cause issues with the website's cryptography algorithms. > 6. Even people experienced in cryptography and hashing make mistakes. A product made by someone learning about them is... Suspect. That's why it's open source and uses standard algorithms like Scrypt, SHA256, SHAKE256 to derive passwords. Pashword is a simple PKBDF algorithm at the end of the day. > A password manager is 100% the better choice every time. For the people in my life who don't want to learn how to use a password manager, then a notebook at their desk at home is the second best option. I agree that password managers are better but the second one is not a good advice. I'd argue Pashword is a much better choice.

rkagerer 4y ago

And when the website forces you to rotate your password? Will you have facebook.com-2, facebook.com-3, etc?

NayamAmarshe 4y ago
That's one of the flaws. No way to really avoid this since Pashword is a hashing algorithm basically.

shudza 4y ago

I like it, many people use a single password for every website, this could keep them safer. Maybe make a browser extension?

NayamAmarshe 4y ago
Yes, I was working on a browser extension but got busy with work. I'll get back on it as soon as I get some time :)

throwanem 4y ago

Not so much on the technical side, but from a product perspective I can't get over how the name, when spoken aloud, sounds like it's had a couple drinks too many or maybe lost its upper denture plate.

tallanvor 4y ago

Other people have hit on some/all of these issues, but here's my list of why I would never consider using this, and would do everything I could to convince friends and family never to use it either: 1. If I have to change my password for any reason, I would have to come up with a new secret key since the site/username would never change. Suddenly I'm stuck having to remember multiple secret keys. 2. Poor control over the length of the passwords - you only provide 3 options, and 20 characters is pretty low. 3. You can't exclude certain certain characters - yes, it's stupid for companies to not allow certain characters in the password, but many sites still do so. 4. If I try to just put in an app name, you tell me to use a real URL. 5. It was SLOW. Maybe it's just busy, but I'd rather not have to generate the password every time. 6. Even people experienced in cryptography and hashing make mistakes. A product made by someone learning about them is... Suspect. A password manager is 100% the better choice every time. For the people in my life who don't want to learn how to use a password manager, then a notebook at their desk at home is the second best option.

NayamAmarshe 4y ago
> 1. If I have to change my password for any reason, I would have to come up with a new secret key since the site/username would never change. Suddenly I'm stuck having to remember multiple secret keys. Yep, just like you would with a normal password. Pashword is not a password manager replacement, it's just a helper for when you wanna generate strong passwords that you re-generate anytime. > 2. Poor control over the length of the passwords - you only provide 3 options, and 20 characters is pretty low. The point is to not remember the password length for each website, hence the 3 options. > You can't exclude certain certain characters - yes, it's stupid for companies to not allow certain characters in the password, but many sites still do so. You can, actually. Just press the 'Not working?' button :) > 4. If I try to just put in an app name, you tell me to use a real URL. Oh right, that's a valid point. I'll remove the domain requirement. > 5. It was SLOW. Maybe it's just busy, but I'd rather not have to generate the password every time. The algorithm is pretty computation heavy, to avoid brute force attacks even with ASICs. If you use Bromite, the privacy settings can cause issues with the website's cryptography algorithms. > 6. Even people experienced in cryptography and hashing make mistakes. A product made by someone learning about them is... Suspect. That's why it's open source and uses standard algorithms like Scrypt, SHA256, SHAKE256 to derive passwords. Pashword is a simple PKBDF algorithm at the end of the day. > A password manager is 100% the better choice every time. For the people in my life who don't want to learn how to use a password manager, then a notebook at their desk at home is the second best option. I agree that password managers are better but the second one is not a good advice. I'd argue Pashword is a much better choice.