Hacker News Reader

Comment by amelius | Hacker News Reader

Anybody else here simply hashing their master password with the domain name of the website?

I think this is something the browser should offer by default.

If your master password leaks you are exposed on every website where you used this scheme (and you should then change every password), so on the security side this is inferior to a master password granting access to uncorrelated passwords.

Well, you can add a salt to this scheme.

I know, it's not perfect, but it beats carrying around password files between devices.

But you would just need to carry the salt around instead. You're just trading convenience for (significantly) lower security.

Yes, it's a trade-off.

By the way, I'd prefer to have a password manager on my phone (or smartwatch), and have it beam my password to my keyboard by NFC. But this solution does not exist yet.

As the other commenter pointed out, you need to carry your salt with you to deduce the actual password. On top of that, you need to keep your salt secret, otherwise it is trivial to deduce your password. So your system [password = hash(master password, salt, domain)] is exactly the same as a master password protecting several other ones. Just use your salt as a password directly at this point...

Such ideas are already implemented in deterministic password managers (erm generators) which have a some key security issues related to portablility and weaker schemes that can be hacked and if your master password is compromised or insecure. A bad idea in my opinion.

How do you rotate passwords?

Yes, I do something like this, along with storing the password requirements and username/domain in localStorage and allowing it to sync between devices: https://webpass.rkeene.org/

What about websites that require to have special characters in your password, since the hash is just HEX? What about multiple accounts on the same website, same password?

A hash is a value. You don't have to encode it in hex.

typically the hashes are represented as a sequence of hexadecimal digits, just as an example md5 and sha265

Hash value is just a value picked out of some domain. For most hashes this domain is Z_{2^n} with n usually divisible by 8. It is then convenient to represent that as hexadecimal number, but there is nothing special about that particular encoding. For purpose of generating secure password you can even use said hash as seed for CSPRNG and then use it for FIPS 181 random password generator algorith or something similar.

Reply on news.ycombinator.com