palant

21 ms·

1. 181.▲
   by palant 10y ago

   Thank you for the reminder, I added the disclaimer noting that I develop Easy Passwords. The claim that vulnerabilities still exist was unsourced six months ago - now you have proof that they do. It would be naive to assume that this was th
2. 182.▲
   Show HN: Easy Passwords – comfortable password generator for your browser(palant.de)

   7 points by palant 10y ago|0 comments
3. 183.▲
   by palant 10y ago

   Ah, I see. Yes, I have a similar one for Easy Passwords under https://palant.github.io/easypasswords/online.html - but it has a huge warning on it. This is not secure indeed and the recommended way of using that page i
4. 184.▲
   by palant 10y ago

   For reference, I am the author of the Easy Passwords extension which uses a similar concept. 5. The user-specific part is the user name. As long as these two users don't use the same user names they won't have the same passwords.
5. 185.▲
   by palant 10y ago

   I don't think that this is sufficient as long as 8192 is still the default. Personally, I don't think that exposing the number of iteration is a good idea at all - users have no way of knowing how much is enough. Frankly, it took
6. 186.▲
   by palant 10y ago

   Please don't use that, the password derivation "algorithm" used there is extremely weak. I explained the issue a while ago here: https://palant.de/2016/04/20/security-considerations-for-pas...
7. 187.▲
   by palant 10y ago

   SHA512 is astronomically more secure how exactly? Under which scenarios? Just so you know: SHA1 is problematic because of potential collision attacks. So you should definitely not use SHA1 for signing anything because it might be possible t
8. 188.▲
   by palant 10y ago

   I was quite surprised to see your extension, it is very similar to my Easy Passwords extension in both concept and design. I've had a brief look at the source code and I guess that it was a completely unrelated development after all? P
9. 189.▲
   by palant 10y ago

   For reference, I am the author of Easy Passwords extension which uses a very similar concept. These issues are definitely solvable, at least if you use a hybrid concept: while most passwords are generated, some can be encrypted and stored (
10. 190.▲
    by palant 10y ago

    You better add a huge "do not use" warning to that blog post. Deriving passwords via SHA-512 or similar is a very common mistake and makes guessing your master password way too easy. I outlined the details in my blog post here: h
11. 191.▲
    by palant 10y ago

    For reference, I am the author of Easy Passwords extension which uses a very similar concept. Your concerns are valid of course but not necessarily for PBKDF2 which is used here. As long as a significantly high number of iterations is used