4 ms·

I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, a

by timtadh 14y ago

I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then copy them off the screen. https://github.com/timtadh/passmash https://github.com/timtadh/passmash

undantag 14y ago
Have you looked at http://supergenpass.com/ http://supergenpass.com/ ? Sounds similar. There's a nice chrome extension and android app available for that algorithm.
- ibotty 14y ago
  it does not stretch and does not even use a serious hash (md5). it is also completely predictable how it builds its per-domain passwords. this will only work for very good master passwords. and even then it will disclose your master password after a while. (it doesn't help either that its example master password is 'snowflake'...)
JonnieCache 14y ago
pwdhash is a project out of stanford that wraps all this up into a browser extension. It just hashes your password with the domain you're logging into. https://www.pwdhash.com/ https://www.pwdhash.com/ the paper: http://crypto.stanford.edu/PwdHash/pwdhash.pdf http://crypto.stanford.edu/PwdHash/pwdhash.pdf
- muellerwolfram 14y ago
  wow thats so cool. for a long time now, i've been looking for a solution. i tried keepass, but it doesn't really work well in linux, and i don't have my passwords on other computers. then i tried lastpass, but i don't like the idea of my passwords beeing stored somewhere else (even though they are encrypted). this sounds like a solid solution to the easy-to-remember but different-password-for-each-site problem. definitely gonna give it a try.
  - stcredzero 14y ago
    i tried keepass, but it doesn't really work well in linux The integration might be less than for Windows and OS X. It works great for me on those systems, though. i don't have my passwords on other computers. I just keep a KeePass file in Dropbox. I also have a KeePass app on my phone.
  - Nick_C 14y ago
    > i tried keepass, but it doesn't really work well in linux, Try KeePassX http://www.keepassx.org/ http://www.keepassx.org/ which works really well in Linux. It even has a hot key to push username and password into the appropriate fields in the browser. I installed it a week or so ago (after trying others) and am pretty impressed so far.
- JoyxBen 14y ago
  this is perfect, thanks for the tip Edit: I notice it uses MD5 though. Question: how secure would this kind of system be with bcrypt and an OS X Password Assistant "memorable" 12 char password?

by timtadh 14y ago

undantag 14y ago

Have you looked at http://supergenpass.com/ http://supergenpass.com/ ? Sounds similar. There's a nice chrome extension and android app available for that algorithm.

ibotty 14y ago
it does not stretch and does not even use a serious hash (md5). it is also completely predictable how it builds its per-domain passwords. this will only work for very good master passwords. and even then it will disclose your master password after a while. (it doesn't help either that its example master password is 'snowflake'...)

JonnieCache 14y ago

pwdhash is a project out of stanford that wraps all this up into a browser extension. It just hashes your password with the domain you're logging into. https://www.pwdhash.com/ https://www.pwdhash.com/ the paper: http://crypto.stanford.edu/PwdHash/pwdhash.pdf http://crypto.stanford.edu/PwdHash/pwdhash.pdf

muellerwolfram 14y ago
wow thats so cool. for a long time now, i've been looking for a solution. i tried keepass, but it doesn't really work well in linux, and i don't have my passwords on other computers. then i tried lastpass, but i don't like the idea of my passwords beeing stored somewhere else (even though they are encrypted). this sounds like a solid solution to the easy-to-remember but different-password-for-each-site problem. definitely gonna give it a try.
- stcredzero 14y ago
  i tried keepass, but it doesn't really work well in linux The integration might be less than for Windows and OS X. It works great for me on those systems, though. i don't have my passwords on other computers. I just keep a KeePass file in Dropbox. I also have a KeePass app on my phone.
- Nick_C 14y ago
  > i tried keepass, but it doesn't really work well in linux, Try KeePassX http://www.keepassx.org/ http://www.keepassx.org/ which works really well in Linux. It even has a hot key to push username and password into the appropriate fields in the browser. I installed it a week or so ago (after trying others) and am pretty impressed so far.
JoyxBen 14y ago
this is perfect, thanks for the tip Edit: I notice it uses MD5 though. Question: how secure would this kind of system be with bcrypt and an OS X Password Assistant "memorable" 12 char password?