3 ms·
If you aren't groking what this is about the example given in article is awesome. http://mattt.github.com/Chroma-Hash/ http://mattt.github.com/Chroma-Hash/ Mat
by sh1mmer 17y ago
If you aren't groking what this is about the example given in article is awesome. http://mattt.github.com/Chroma-Hash/ http://mattt.github.com/Chroma-Hash/
Mattt-triple-t was our intern at the Yahoo! Developer Network last year and sent us this a couple of weeks ago. It's a really solid example implementation. You should play with it.
- didroe 17y agoOne thing that's weird in the example is that there's a confirm password box. The only utility I can see for Chroma Hash is in removing the need to confirm passwords. You'd need widespread use for people to remember their hashes though.
- phobos 17y agoIn some of our internal apps we have the data entry folks double key information into password fields (i.e. bank account, social security number). This would give them an opportunity to see if they mis-keyed something before submission and validation. I like it.
- tptacek 17y agoWhat makes this "really solid"? If you mean, as an example of JS interactivity design, then yes. I agree. It's slick and it works as advertised. If you mean, as an example of a safe extension to the most security-critical part of your application, then no. It's the opposite of solid. It's essentially publishing information that can be used to recover your password to the world. I'm mystified as to how people could think this is a win.
- jrockway 17y agoThis is the least of your worries when you aren't submitting your password over SSL anyway. Also, I doubt my cat really cares about guessing my password.
- tptacek 17y agoI think what makes these bad-idea visualizers palatable to people is that they assume the applications that use them will only be used by a couple hundred people in their bedrooms or home offices. I think what makes them so repellent to me is the thought that one of those applications might become the next Twitter. SSL vs. password visualization, which is worse? Depends on your threat model, I guess. It's academic to me. You should be using SSL also.
- sh1mmer 17y agoI meant the User Experience rather than the code. I'm not sure I agree with your security analysis though. The concept is to provide a visual cue for the password that's hard to manually reverse engineer.
- tptacek 17y agoSee elsewhere in the comments for how to break the hash.