4 ms·

I use SuperGenPass, which hashes the domain of a website with a Master password, so you only need to remember one password. Then, every time you log in, you jus

by maneesh 18y ago

I use SuperGenPass, which hashes the domain of a website with a Master password, so you only need to remember one password. Then, every time you log in, you just enter in your master password, it automatically hashes it, and you get a new password for logging in like af49AgsdU8 EDIT: here's the link http://www.supergenpass.com/ http://www.supergenpass.com/

paulgb 18y ago
Amen. It amazes me how little this has caught on with the technical people I know. You can have your cake and eat it too: you only need to remember a single password, but you get to keep that password private. And you can use as many different computers and browsers as you want.
tdavis 18y ago
Holy crap, how have I not heard of this?! I love 1Password, but I wish they supported Opera. I would almost switch to this if it weren't for the need to reset hundreds of passwords.
- drenei 18y ago
  I know! Where's the news on this been? This sounds awesome - more research, but I'm seriously thinking about switching.
SwellJoe 18y ago
I've also been using this for ages. Absolute huge time saver. I used to keep vim encrypted files for every site I visited...when the list topped about three hundred, it seemed like time for a change.
brl 18y ago
This scheme is hugely flawed. If you steal a password list from a website you can identify all the passwords generated by this utility (10 characters, uniform distribution over alphanumeric characters) and then simply crack the master passwords with a brute force attack. If you have stolen multiple SuperGenPass generated passwords from the same website, you can crack them all at the same time with no additional penalty. After recovering the master password you can then log into every single online account belonging to the user. They seem to generate the password hash with simple md5, which is about the worst possible choice they could have made. Any master password which is low entropy enough to carry around in your brain can probably be cracked in a few days at most.
- jsteele 18y ago
  Except that you don't use the full MD5 sum, so it's not a simple matter of brute-forcing it.
  - brl 18y ago
    For the default password length of 10 characters they use ~60 bits of MD5 output. That's more than enough information to uniquely identify the master password.
jcs 18y ago
So once your master password is found (brute force/keylogger/shoulder surfing), the attacker has a handy bookmarklet to log into all of your accounts.

by maneesh 18y ago

paulgb 18y ago

Amen. It amazes me how little this has caught on with the technical people I know. You can have your cake and eat it too: you only need to remember a single password, but you get to keep that password private. And you can use as many different computers and browsers as you want.

tdavis 18y ago

Holy crap, how have I not heard of this?! I love 1Password, but I wish they supported Opera. I would almost switch to this if it weren't for the need to reset hundreds of passwords.

drenei 18y ago
I know! Where's the news on this been? This sounds awesome - more research, but I'm seriously thinking about switching.

SwellJoe 18y ago

I've also been using this for ages. Absolute huge time saver. I used to keep vim encrypted files for every site I visited...when the list topped about three hundred, it seemed like time for a change.

brl 18y ago

This scheme is hugely flawed. If you steal a password list from a website you can identify all the passwords generated by this utility (10 characters, uniform distribution over alphanumeric characters) and then simply crack the master passwords with a brute force attack. If you have stolen multiple SuperGenPass generated passwords from the same website, you can crack them all at the same time with no additional penalty. After recovering the master password you can then log into every single online account belonging to the user. They seem to generate the password hash with simple md5, which is about the worst possible choice they could have made. Any master password which is low entropy enough to carry around in your brain can probably be cracked in a few days at most.

jsteele 18y ago
Except that you don't use the full MD5 sum, so it's not a simple matter of brute-forcing it.
- brl 18y ago
  For the default password length of 10 characters they use ~60 bits of MD5 output. That's more than enough information to uniquely identify the master password.

jcs 18y ago

So once your master password is found (brute force/keylogger/shoulder surfing), the attacker has a handy bookmarklet to log into all of your accounts.