4 ms·

That's a cool extension, but I can't see it gain massive popularity. There is a class of problems with it that wfor a site ould be solved if you make it a book

by ntoshev 17y ago

That's a cool extension, but I can't see it gain massive popularity. There is a class of problems with it that wfor a site ould be solved if you make it a bookmarklet (with a companion site): does it support your browser, what if you need to log in from a computer that doesn't have this browser extension? The real problem is that if you are security-conscious enough to understand how this works and why you need it, you are not using the same password over and over again. E.g. I have a "weak" password that I use on HN and many other sites, but my mail and sites that involve (even remotely) money get an individual password each.

snprbob86 17y ago
Personally, I'd like to see this become a feature of the HTML 5 standard. I'd also make it opt-out if you specify your doctype as HTML 5. That would certainly help drive adoption. Who do I send that suggestion to? :-) I love PwdHash because it is a relatively simple solution to a relatively complicated problem. This is just further proof that "secure by design" is the only real way to do security.
- Shakescode 17y ago
  I understand the attractiveness of the convenience, but (perhaps it's just my paranoia) should one approach to security and how users handle it be codified into a standard at this point: shouldn't we be concerned about what currently unknown weaknesses may fall to cracking approaches that develop within a few short years?
barrkel 17y ago
I use SuperGenPass, which has a bookmarklet which does exactly this; for FF and Safari, the entire Javascript code can be stored in the bookmarklet, and does the hashing process without having to go to another site. For IE, it loads the script from supergenpass.com. There's an offline version as well. I do use a weak password for throwaway sites, but I use hashing (supergenpass) to make sure the (weak) password is unique for each site.

by ntoshev 17y ago

snprbob86 17y ago

Personally, I'd like to see this become a feature of the HTML 5 standard. I'd also make it opt-out if you specify your doctype as HTML 5. That would certainly help drive adoption. Who do I send that suggestion to? :-) I love PwdHash because it is a relatively simple solution to a relatively complicated problem. This is just further proof that "secure by design" is the only real way to do security.

Shakescode 17y ago
I understand the attractiveness of the convenience, but (perhaps it's just my paranoia) should one approach to security and how users handle it be codified into a standard at this point: shouldn't we be concerned about what currently unknown weaknesses may fall to cracking approaches that develop within a few short years?

barrkel 17y ago

I use SuperGenPass, which has a bookmarklet which does exactly this; for FF and Safari, the entire Javascript code can be stored in the bookmarklet, and does the hashing process without having to go to another site. For IE, it loads the script from supergenpass.com. There's an offline version as well. I do use a weak password for throwaway sites, but I use hashing (supergenpass) to make sure the (weak) password is unique for each site.