Hacker News Reader

Comment by antirez | Hacker News Reader

poor man's password manager: select one strong password that you are able to keep in mind. Then for every site you use, set the password to what is the output of:

    echo "strong_pass:sitename:strong_pass" | sha1sum

Note: if you are using mac os x use "shasum" instead of "sha1sum".

Make sure to don't expose your secure password of course. It's also a good idea to use a completely different strong password just for email.

p.s. it's worth to note that since there are tons fo SHA implementations for Javascript it's possible to build all this as a web application where all the business happens in the client.

The web app will just allow you to add a number of site names so that you don't have to type the site name by hand all the times.

Btw the world would be a better place with all the auth cookies set to expire on 2036...

View on HN

Unfortunately some crappy site is going to thwart such an effort. "bzzz! you can only use 12 chars in your password" or "you have to use a symbol/uppercase letter" or some other lunacy. le sigh

And that site will more than likely be your bank to boot.

I have a feeling that some old bank software has fixed size fields and that's we get ridiculous maximum lengths on bank passwords.

This is not a great password manager function; the reason is, losing your sha1sum password gives the attacker enough information to mount a very, very fast brute force attack against "strong_pass" as long as they know the "sitename".

A basic property of a password manager system should be that the loss of any password doesn't give attackers any information about other passwords; yours potentially concedes the "master secret" that animates all of them.

SuperGenPass (http://supergenpass.com/) does that in a way that is more likely to generate strong passwords honored by sites (e.g., multiple cases, punctuation, etc.). It comes both as a bookmarklet, and, if you don't want to use that, a mobile version (http://supergenpass.com/mobile/) that you can store somewhere safe so it doesn't even hit the internet (e.g., I store it on my Dropbox account so I can use it on my phone). Works great.

There's also an extension for Chrome called SuperChromePass that allows you to generate your passwords outside of the DOM to prevent snooping, or use Ctrl-Shift-P to do in-DOM generation for convenience, depending on your preference and paranoia.

That said, I've been using SGP/SCP for all my passwords for about a year now, and I have only come across a single site that wouldn't work with the default, 10 character password scheme: ConsumerReports.com

All in all, I would definitely recommend this to everyone because it means you don't have to keep track of an encrypted password database or have any software installed on computers you use. If your computer crashes and you lose all your data, you just put SGP back on your bookmarks bar and carry on with life...

Why use the strong_pass twice?

otherwise there are attacks possible with this simple schema. Check why it's a good idea to use an HMAC for serious applications instead of "secret:...mytext..." for more details (long story short, it's possible to continue the SHA1 computation resuming from where it ended and appending more text). It's really a problem in different cases, not in our case of generating passwords, but it's a good practice to use always HMAC or when it is not practical like in this case at least putting the secret before and after.

On a mac you might want to try

  cat /dev/urandom | openssl base64 | head -c 12; echo;

Which can give you a nice random string.

  openssl rand -hex 6

will give you 6 random bytes hex-encoded. Your specific command line can be done with:

  openssl rand -base64 9 | cut -c-12

Note, I think you wanted -c-12, not -c12.

this is already available for the major browsers as an extension; try googling for "pwd hash" (from stanford) and "password hasher". also, as was noted in another comment, this is currently being discussed in another thread

This is a brilliant idea!

Reply on news.ycombinator.com