Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think that a better solution is to use pwdhash. Check it out here:

http://pwdhash.com

It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password.

The extensions were created by Blake Ross (big name in the firefox community), as well as Collin Jackson and Dan Boneh who are highly regarded security experts at Stanford.

Also, if you're interested, I've created a command line utility for Mac OS X that exposes the same functionality: https://github.com/ali01/pwdhash.py



Just yesterday I wrote a Chrome extension with the same idea. Algorithm is:

    password = base64(pbkdf2(secret, username@url))
Where PBKDF2 uses SHA-256 and 5000 iterations.

You can get it here: https://chrome.google.com/webstore/detail/hegbhhpocfhlnjmemk...

Website version: http://sellme.ru/p2

Source: https://github.com/dchest/cryptopass/


The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.


Actually, that's not true. Look at the encoding section of the PwdHash USENIX paper. PwdHash returns an ASCII representation (not a hex or base64 encoded string) of the hashed domain name + master password. PwdHash also applies a number of constraints to the returned hash to ensure that the special characters that it does use are legal at most websites.

A typical PwdHash password, with domain name google.com and master password "LetMeIn+123456?" looks like this:

6+LYoE/C0wP8dGPoO

Try it yourself at the pwdhash website.


Oh, good to know. I stand corrected. I was using supergenpass but I should switch to pwdhash, then.


Optimal? No. More than sufficient? Yes. You can use all numbers in your password, so long as it's long enough (and the website actually uses all of them).


I use a hashing bookmarklet myself. Only, I wish there was a better algorithm and I think it's wise, at least with an audience like HN, to point the weaknesses of those system. See for instance : http://stackoverflow.com/questions/554224/is-the-bookmarklet...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: