4 ms·
let's me pick the hashing algo, All of the choices are hash functions designed to be fast (like SHA-256, the default), which you do not want for password deriv
by uvdiv 14y ago
let's me pick the hashing algo,
All of the choices are hash functions designed to be fast (like SHA-256, the default), which you do not want for password derivation because being fast to compute means easy to brute-force. You can test billions of digests per second with a PC graphics card.
let's me specify a different salt (domain of the site is the default)
Then every user shares the same salt for a given site, which largely defeats the purpose of salting (to prevent rainbow tables).
- rapind 14y agoYeah the salt default being an issue, is what I said in my initial post. I'm going to go out on a limb and say that doing the following will make you one of the hardest passwords to crack during the event of a weak hashing leak like the linkedin fiasco. 1. Install and use the Passwordmaker Pro extension. https://chrome.google.com/webstore/detail/ocjkdaaapapjpmipmhiadedofjiokogj https://chrome.google.com/webstore/detail/ocjkdaaapapjpmipmh... 2. Change the default password length to say 40 characters. 3. Add a modifier like bOoo7&jd8$02jf 4. Change whatever other defaults you want. 5. Use a master password that's at least 10 characters long. BTW it would be easy enough to fork this extension and provide a little more security if you wanted. https://github.com/bitboxer/chrome-passwordmaker/ https://github.com/bitboxer/chrome-passwordmaker/