2 ms·

It is not safe to enter your master password on a random website like password.ly. The risk is simply too high that it gets hacked someday and your master passw

by tinco 14y ago

It is not safe to enter your master password on a random website like password.ly. The risk is simply too high that it gets hacked someday and your master password will fall. That it is not stored in a database is only a small advantage. If whoever controls password.ly wants to have all passwords, she could do so whenever she wants, a matter of a simple extra request. It could even be hidden in the params of any link on password.ly (to prevent you from noticing the extra request). And that reveals the second big problem with this: The master password is basically every password. If it falls in the wrong hands you are worse off than you would be if you have a small set of passwords, which isn't a highly recommended strategy in itself. But the idea itself isn't too bad, if you would instead of using password.ly use a terminal bcrypt command to bcrypt your password+sitename it would be very decent indeed. The only way sites like this could be safe to use is if there would be a code-signing standard for the web. edit: This service actually sends your password to their service! At first I thought it was an innocuous enough javascript password generator, but this is so stupid it borders on malice..

qixxiq 14y ago
There is a command line client too, and the entire website is open source (links at bottom.) If you're worried about not trusting anyone, then you would need to set up your own solution - but for most people thats completely out of their league. This is intended for people who would be typing their master password in different websites, and now instead only need to type their master password into one. I can't argue against the problem of only having one password, but the small set never worked for me. I have a couple plans to integrate password migration into password.ly.
- smutticus 14y ago
  > and the entire website is open source (links at bottom.) How do I know the code released for review is actually the code they're running on their server? There is no way they can adequately prove this to me.
  - jrogers65 14y ago
    Simple solution is to self-host it.
- tinco 14y ago
  I understand your point, I've thought about launching a site like this too, but the single host problem is just too big of a flaw. It has nothing to do with trusting anyone, if a service like this should grow out of obscurity it would naturally become a target for hackers, just like the Bitcoin exchanges did for example. There is almost no protecting against this, the attack vectors are endless, and the bounty could be very large.

by tinco 14y ago

qixxiq 14y ago

There is a command line client too, and the entire website is open source (links at bottom.) If you're worried about not trusting anyone, then you would need to set up your own solution - but for most people thats completely out of their league. This is intended for people who would be typing their master password in different websites, and now instead only need to type their master password into one. I can't argue against the problem of only having one password, but the small set never worked for me. I have a couple plans to integrate password migration into password.ly.

smutticus 14y ago
> and the entire website is open source (links at bottom.) How do I know the code released for review is actually the code they're running on their server? There is no way they can adequately prove this to me.
- jrogers65 14y ago
  Simple solution is to self-host it.
tinco 14y ago
I understand your point, I've thought about launching a site like this too, but the single host problem is just too big of a flaw. It has nothing to do with trusting anyone, if a service like this should grow out of obscurity it would naturally become a target for hackers, just like the Bitcoin exchanges did for example. There is almost no protecting against this, the attack vectors are endless, and the bounty could be very large.