4 ms·

You know what I would love? A strong generator for the password field. My browser remembers all my password but I still have to generate a strong one by myself,

You know what I would love? A strong generator for the password field. My browser remembers all my password but I still have to generate a strong one by myself, which is completely unnecessary. I don't even have to see it; in worst case, I will simply request a password reset.

haraball 15y ago
I'm using LastPass for this, you can specify how strong your unique generated password should be and it stores it for you. There are other similar ones like this also.
- Spearchucker 15y ago
  Always amazed when I hear people use services like LastPass. Your password. In someone else's database. I'm not saying LastPass (or any similar service) is bad. I am however amused at the anger we display when the likes of Path upload our contacts without our knowledge, while we voluntarily give our most sensitive data (passwords, and the locations they're used at) to a third party to manage.
  - dorian-graph 15y ago
    An alternate, and which I use, is 1Password which doesn't store our database of passwords and whatnot on their services as it's a local file. You can sync it with Dropbox and it's therefore on Dropbox's servers but it's secured in some way. I remember trying LastPass but dropped it because of security worries. You're definitely right about it being amusing at what get's people in a row. The main difference between this and the phone apps is that they deliberately chose to place their data with LastPass. So, it seems to be not the content but the authority that matters.
    - LinaLauneBaer 15y ago
      Remark: As far I know 1Password does not encrypt everything. Lets say you store a password in 1Password for twitter.com then the password is being encrypted but the information that the password is used for twitter.com is not. So someone could find out that you are using twitter simply by going through your 1Password file. This may be a problem with sites that are not as harmless like twitter.
      - nickyp 15y ago
        Interesting observation. I checked a couple of my 1Password files and you're right: usernames & passwords are encrypted, but not the website/URL they're associated with.
  - finnw 15y ago
    I don't know how similar online password managers work, but I use PassPack. They store your whole encrypted password file in one field in their database, and the encryption/decryption is done only on the client side. The key is never transmitted over the internet. This doesn't do anything to defend against client-side malware, but at least if their database is stolen the bad guys will be unable to decrypt your passwords (as long as your passphrase is strong enough.) There is a weakness - they keep historical versions of your password file. Presumably because some customers forget their new passphrase but remember their old one and so they can recover their file, less any edits since they changed their passphrase. But if you changed your passphrase because your old one was compromised, the bad guys can now decrypt the old version and have a chance to get some still-current passwords from it.
  - icebraining 15y ago
    I don't use LastPass, but: 1) Using LastPAss doesn't mean one stores sensitive passwords in it. You can memorize a few that really matter (email, bank, etc) and keep the rest there. 2) They claim it's secure: This is important because your sensitive data is always encrypted and decrypted locally on your computer before being synchronized. Your master password never leaves your computer and your key never leaves your computer. No one at LastPass (or anywhere else) can decrypt your data without you giving up your password (we will never ask you for it). https://lastpass.com/support.php?cmd=showfaq&id=1096 https://lastpass.com/support.php?cmd=showfaq&id=1096
    - david_a_r_kemp 15y ago
      I use LastPass with the 2 factor-authentication. It doesn't have my email password in it (which also requires 2-factor authentication).
cpeterso 15y ago
I use SuperGenPass, a password-generating bookmarklet. Instead of storing your passwords (locally or on a server), SuperGenPass generates a strong, site-specific password by hashing your master password and the site's hostname. I remember just one master password, but no site has the same password in their database. The problem is when some site has unusual password requirements that SuperGenPass can't support. Then I must make up and remember a password for that site. :( http://supergenpass.com/ http://supergenpass.com/
- decode 15y ago
  > The problem is when some site has unusual password requirements that SuperGenPass can't support. Then I must make up and remember a password for that site. :( PasswordMaker is similar to SuperGenPass, but you can create exceptions to your default password scheme on a site-by-site basis. So, you can use lower complexity and shorter passwords for sites that have bad password policies, but still use better passwords for those that support them. http://passwordmaker.org/ http://passwordmaker.org/
  - cpeterso 15y ago
    A serious deficiency in PasswordMaker is that, by default, it ignores subdomains, so bbc.co.uk and evil.co.uk would share the same password. But if you enable the subdomain option, then www.bbc.co.uk and www2.bbc.co.uk then have different passwords.
    - decode 15y ago
      I'm using the Firefox add-on version 1.7.8, with the default URL Components settings (subdomains not enabled), and it uses "bbc.co.uk" as the domain for "www.bbc.co.uk" and "evil.co.uk" as the domain for "evil.co.uk", so the problem you described doesn't exist. Maybe this was a problem in an earlier version and it's been fixed?
      - cpeterso 15y ago
        I'll have to double-check. The problem is still reproducible on the (albeit limited) PasswordMaker online version: http://passwordmaker.org/passwordmaker.html http://passwordmaker.org/passwordmaker.html

haraball 15y ago

I'm using LastPass for this, you can specify how strong your unique generated password should be and it stores it for you. There are other similar ones like this also.

Spearchucker 15y ago
Always amazed when I hear people use services like LastPass. Your password. In someone else's database. I'm not saying LastPass (or any similar service) is bad. I am however amused at the anger we display when the likes of Path upload our contacts without our knowledge, while we voluntarily give our most sensitive data (passwords, and the locations they're used at) to a third party to manage.
- dorian-graph 15y ago
  An alternate, and which I use, is 1Password which doesn't store our database of passwords and whatnot on their services as it's a local file. You can sync it with Dropbox and it's therefore on Dropbox's servers but it's secured in some way. I remember trying LastPass but dropped it because of security worries. You're definitely right about it being amusing at what get's people in a row. The main difference between this and the phone apps is that they deliberately chose to place their data with LastPass. So, it seems to be not the content but the authority that matters.
  - LinaLauneBaer 15y ago
    Remark: As far I know 1Password does not encrypt everything. Lets say you store a password in 1Password for twitter.com then the password is being encrypted but the information that the password is used for twitter.com is not. So someone could find out that you are using twitter simply by going through your 1Password file. This may be a problem with sites that are not as harmless like twitter.
    - nickyp 15y ago
      Interesting observation. I checked a couple of my 1Password files and you're right: usernames & passwords are encrypted, but not the website/URL they're associated with.
- finnw 15y ago
  I don't know how similar online password managers work, but I use PassPack. They store your whole encrypted password file in one field in their database, and the encryption/decryption is done only on the client side. The key is never transmitted over the internet. This doesn't do anything to defend against client-side malware, but at least if their database is stolen the bad guys will be unable to decrypt your passwords (as long as your passphrase is strong enough.) There is a weakness - they keep historical versions of your password file. Presumably because some customers forget their new passphrase but remember their old one and so they can recover their file, less any edits since they changed their passphrase. But if you changed your passphrase because your old one was compromised, the bad guys can now decrypt the old version and have a chance to get some still-current passwords from it.
- icebraining 15y ago
  I don't use LastPass, but: 1) Using LastPAss doesn't mean one stores sensitive passwords in it. You can memorize a few that really matter (email, bank, etc) and keep the rest there. 2) They claim it's secure: This is important because your sensitive data is always encrypted and decrypted locally on your computer before being synchronized. Your master password never leaves your computer and your key never leaves your computer. No one at LastPass (or anywhere else) can decrypt your data without you giving up your password (we will never ask you for it). https://lastpass.com/support.php?cmd=showfaq&id=1096 https://lastpass.com/support.php?cmd=showfaq&id=1096
  - david_a_r_kemp 15y ago
    I use LastPass with the 2 factor-authentication. It doesn't have my email password in it (which also requires 2-factor authentication).

cpeterso 15y ago

I use SuperGenPass, a password-generating bookmarklet. Instead of storing your passwords (locally or on a server), SuperGenPass generates a strong, site-specific password by hashing your master password and the site's hostname. I remember just one master password, but no site has the same password in their database. The problem is when some site has unusual password requirements that SuperGenPass can't support. Then I must make up and remember a password for that site. :( http://supergenpass.com/ http://supergenpass.com/

decode 15y ago
> The problem is when some site has unusual password requirements that SuperGenPass can't support. Then I must make up and remember a password for that site. :( PasswordMaker is similar to SuperGenPass, but you can create exceptions to your default password scheme on a site-by-site basis. So, you can use lower complexity and shorter passwords for sites that have bad password policies, but still use better passwords for those that support them. http://passwordmaker.org/ http://passwordmaker.org/
- cpeterso 15y ago
  A serious deficiency in PasswordMaker is that, by default, it ignores subdomains, so bbc.co.uk and evil.co.uk would share the same password. But if you enable the subdomain option, then www.bbc.co.uk and www2.bbc.co.uk then have different passwords.
  - decode 15y ago
    I'm using the Firefox add-on version 1.7.8, with the default URL Components settings (subdomains not enabled), and it uses "bbc.co.uk" as the domain for "www.bbc.co.uk" and "evil.co.uk" as the domain for "evil.co.uk", so the problem you described doesn't exist. Maybe this was a problem in an earlier version and it's been fixed?
    - cpeterso 15y ago
      I'll have to double-check. The problem is still reproducible on the (albeit limited) PasswordMaker online version: http://passwordmaker.org/passwordmaker.html http://passwordmaker.org/passwordmaker.html