3 ms·
That looks like they're using unsalted SHA-256 as a password derivation function? And they reimplemented every cryptographic primitive themselves? I'll pass.
by uvdiv 14y ago
That looks like they're using unsalted SHA-256 as a password derivation function? And they reimplemented every cryptographic primitive themselves?
I'll pass.
- rapind 14y agoNot sure where you got that idea, but the Passwordmaker Pro chrome extension I'm using, let's me specify a different salt (domain of the site is the default), let's me pick the hashing algo, the length of the hash, the modifier, characters to use, etc. You might want to look at it again.
- uvdiv 14y agolet's me pick the hashing algo, All of the choices are hash functions designed to be fast (like SHA-256, the default), which you do not want for password derivation because being fast to compute means easy to brute-force. You can test billions of digests per second with a PC graphics card. let's me specify a different salt (domain of the site is the default) Then every user shares the same salt for a given site, which largely defeats the purpose of salting (to prevent rainbow tables).
- rapind 14y agoYeah the salt default being an issue, is what I said in my initial post. I'm going to go out on a limb and say that doing the following will make you one of the hardest passwords to crack during the event of a weak hashing leak like the linkedin fiasco. 1. Install and use the Passwordmaker Pro extension. https://chrome.google.com/webstore/detail/ocjkdaaapapjpmipmhiadedofjiokogj https://chrome.google.com/webstore/detail/ocjkdaaapapjpmipmh... 2. Change the default password length to say 40 characters. 3. Add a modifier like bOoo7&jd8$02jf 4. Change whatever other defaults you want. 5. Use a master password that's at least 10 characters long. BTW it would be easy enough to fork this extension and provide a little more security if you wanted. https://github.com/bitboxer/chrome-passwordmaker/ https://github.com/bitboxer/chrome-passwordmaker/