4 ms·
That doesn't quite work in the unfortunately common case of user password re-use. If your hash is constant and stored in plain text somewhere and that place ge
by thatthatis 13y ago
That doesn't quite work in the unfortunately common case of user password re-use. If your hash is constant and stored in plain text somewhere and that place gets hacked -- then your password at every site is compromised.
- mazesc 13y agoecho "this is my pass for $URL" | shasum
- raverbashing 13y agoYes, you need to add a salt, it can be the URL (and something else added)
- Jach 13y agoIf you use an actual bash script instead of a one-liner, and you can do things like 'silently' read in the password with `read -s` in the standard *nix convention, even read it twice to avoid mistyping your master key and temporarily locking yourself out of an account you just created.
- raverbashing 13y agoHere's a tentative crude solution http://pastebin.com/MuV8vtcR http://pastebin.com/MuV8vtcR you can pass a "salt" as the first argument as well (it will merely be concatenated with the password)
- Jach 13y agoYou should quote your vars in the if check, otherwise it doesn't handle spaces very well. (And really the master key should be a master passphrase.) A few years ago I whipped this up: http://www.thejach.com/public/pw2 http://www.thejach.com/public/pw2 (I don't recommend other people use it but it works for me.) I type in something along the lines of "my secret passphrase ycombinator.com". It doesn't do hash iteration and uses the hash as a seed to Python's RNG which I use to get random bytes and then have a password character-space of any printable character -- it also outputs an alpha-numeric version along with different string sizes to handle those dumb sites that put restrictions on your password.