10 ms·
How is using this tool different from manually concatenating (website name + username + secret key), e.g. “reddit$myname$123456”? Since Reddit would hash it any
by crazylogger 4y ago
How is using this tool different from manually concatenating (website name + username + secret key), e.g. “reddit$myname$123456”? Since Reddit would hash it anyway, this plaintext string should be as secure as a Pashword.
- 8organicbits 4y agoConcatenating leaks your secret key to the website. If a hacker can add JavaScript to the login page of _any_ site you use, then they can record your plaintext password and log into _every_ site you use. Given the reddit password it's immediately obvious that "facebook$myname$123456" is your facebook password. The tool uses scrypt to make it hard to figure out the secret key from the generated password.