5 ms·

A browser plugin that pre-hashes anything in a hidden text field (with a user secret key and the password origination domain) could mimic this as a layer on top

A browser plugin that pre-hashes anything in a hidden text field (with a user secret key and the password origination domain) could mimic this as a layer on top of existing technology. It would have the obvious portability issues, and I'm sure other implementation issues.

raverbashing 13y ago
well, you could even do it manually echo 'this is my pass' | shasum 3b0c5dc943cd30dcd2ca1ff760145f219d3ba3f3 And use that as the password. Of course, this is a very basic example, you should make it more safer by adding a salt and running more iterations. May be easier (and safer) than installing "One password" kind of software.
- thatthatis 13y ago
  That doesn't quite work in the unfortunately common case of user password re-use. If your hash is constant and stored in plain text somewhere and that place gets hacked -- then your password at every site is compromised.
  - mazesc 13y ago
    echo "this is my pass for $URL" | shasum
  - raverbashing 13y ago
    Yes, you need to add a salt, it can be the URL (and something else added)
  - Jach 13y ago
    If you use an actual bash script instead of a one-liner, and you can do things like 'silently' read in the password with `read -s` in the standard *nix convention, even read it twice to avoid mistyping your master key and temporarily locking yourself out of an account you just created.
    - raverbashing 13y ago
      Here's a tentative crude solution http://pastebin.com/MuV8vtcR http://pastebin.com/MuV8vtcR you can pass a "salt" as the first argument as well (it will merely be concatenated with the password)
      - Jach 13y ago
        You should quote your vars in the if check, otherwise it doesn't handle spaces very well. (And really the master key should be a master passphrase.) A few years ago I whipped this up: http://www.thejach.com/public/pw2 http://www.thejach.com/public/pw2 (I don't recommend other people use it but it works for me.) I type in something along the lines of "my secret passphrase ycombinator.com". It doesn't do hash iteration and uses the hash as a seed to Python's RNG which I use to get random bytes and then have a password character-space of any printable character -- it also outputs an alpha-numeric version along with different string sizes to handle those dumb sites that put restrictions on your password.
onli 13y ago
If I understand you correctly, that exists already and is called pwdhash: https://www.pwdhash.com/ https://www.pwdhash.com/. Available online and as browser plugin for the major browsers. The already mentioned supergenpass seems nice as well.
jawr 13y ago
Awesome idea, should randomly salt them for users who insist on using the same password for different sites.
- adamtulinius 13y ago
  "i created my account on machine x, now i can't log in from machine y".
  - jawr 13y ago
    Might be an extreme comparison (beg your pardon if I'm being naive), but it's a similar hinderance to using SSH keys. Carry it around on a USB key, or deal with the security outweighing convenience.
    - thatthatis 13y ago
      I like that. Could even be coupled with a portable browser.
  - livnev 13y ago
    What about determining the salt from the domain for the given login? (perhaps slightly more refined than that to mitigate cases like *.google.com)
    - thatthatis 13y ago
      I think that's right. It would also need some ability to add mappings like "when I log in from gmail.com, hash like it is google.com"
  - thatthatis 13y ago
    That being the obvious portability issue.
fohlin 13y ago
Your idea sounds like an automatic version of SuperGenPass: http://supergenpass.com http://supergenpass.com I've been running it for years, which feels quite nice when sites start leaking passwords left and right.
- thatthatis 13y ago
  How have I functioned as an adult for so long without knowing that this plugin exists? Thank you for sharing, I am going to download this immediately. My current algorithm for passwords is human based so it is an unfortunately simple algo. It provides some additional security over raw reuse but not enough for me to be comfortable.
bentcorner 13y ago
This is (hopefully) a problem that platform owners can solve for us, and if they do I'll love them for it, but they very likely won't take it on. Apple/Google/Microsoft can bake in cross-device syncing into the browser/OS and apply this sort of thing on form auto-fill. It'll break down when: a) Hashes don't meet site-specific password requirements (too long, missing special characters, etc.) b) Sites store passwords in plaintext and you forgot your password and ask for them to email it to you (user: What the hell is this garbage of text, I didn't type this in!) Unfortunately the above problems usually occur on sites where you need this most, and are very hard to solve, and so this problem is therefore unlikely to be solved "neatly" by anybody big.

raverbashing 13y ago

well, you could even do it manually echo 'this is my pass' | shasum 3b0c5dc943cd30dcd2ca1ff760145f219d3ba3f3 And use that as the password. Of course, this is a very basic example, you should make it more safer by adding a salt and running more iterations. May be easier (and safer) than installing "One password" kind of software.

thatthatis 13y ago
That doesn't quite work in the unfortunately common case of user password re-use. If your hash is constant and stored in plain text somewhere and that place gets hacked -- then your password at every site is compromised.
- mazesc 13y ago
  echo "this is my pass for $URL" | shasum
- raverbashing 13y ago
  Yes, you need to add a salt, it can be the URL (and something else added)
- Jach 13y ago
  If you use an actual bash script instead of a one-liner, and you can do things like 'silently' read in the password with `read -s` in the standard *nix convention, even read it twice to avoid mistyping your master key and temporarily locking yourself out of an account you just created.
  - raverbashing 13y ago
    Here's a tentative crude solution http://pastebin.com/MuV8vtcR http://pastebin.com/MuV8vtcR you can pass a "salt" as the first argument as well (it will merely be concatenated with the password)
    - Jach 13y ago
      You should quote your vars in the if check, otherwise it doesn't handle spaces very well. (And really the master key should be a master passphrase.) A few years ago I whipped this up: http://www.thejach.com/public/pw2 http://www.thejach.com/public/pw2 (I don't recommend other people use it but it works for me.) I type in something along the lines of "my secret passphrase ycombinator.com". It doesn't do hash iteration and uses the hash as a seed to Python's RNG which I use to get random bytes and then have a password character-space of any printable character -- it also outputs an alpha-numeric version along with different string sizes to handle those dumb sites that put restrictions on your password.

onli 13y ago

If I understand you correctly, that exists already and is called pwdhash: https://www.pwdhash.com/ https://www.pwdhash.com/. Available online and as browser plugin for the major browsers. The already mentioned supergenpass seems nice as well.

jawr 13y ago

Awesome idea, should randomly salt them for users who insist on using the same password for different sites.

adamtulinius 13y ago
"i created my account on machine x, now i can't log in from machine y".
- jawr 13y ago
  Might be an extreme comparison (beg your pardon if I'm being naive), but it's a similar hinderance to using SSH keys. Carry it around on a USB key, or deal with the security outweighing convenience.
  - thatthatis 13y ago
    I like that. Could even be coupled with a portable browser.
- livnev 13y ago
  What about determining the salt from the domain for the given login? (perhaps slightly more refined than that to mitigate cases like *.google.com)
  - thatthatis 13y ago
    I think that's right. It would also need some ability to add mappings like "when I log in from gmail.com, hash like it is google.com"
- thatthatis 13y ago
  That being the obvious portability issue.

fohlin 13y ago

Your idea sounds like an automatic version of SuperGenPass: http://supergenpass.com http://supergenpass.com I've been running it for years, which feels quite nice when sites start leaking passwords left and right.

thatthatis 13y ago
How have I functioned as an adult for so long without knowing that this plugin exists? Thank you for sharing, I am going to download this immediately. My current algorithm for passwords is human based so it is an unfortunately simple algo. It provides some additional security over raw reuse but not enough for me to be comfortable.

bentcorner 13y ago

This is (hopefully) a problem that platform owners can solve for us, and if they do I'll love them for it, but they very likely won't take it on. Apple/Google/Microsoft can bake in cross-device syncing into the browser/OS and apply this sort of thing on form auto-fill. It'll break down when: a) Hashes don't meet site-specific password requirements (too long, missing special characters, etc.) b) Sites store passwords in plaintext and you forgot your password and ask for them to email it to you (user: What the hell is this garbage of text, I didn't type this in!) Unfortunately the above problems usually occur on sites where you need this most, and are very hard to solve, and so this problem is therefore unlikely to be solved "neatly" by anybody big.