Hacker News Reader

You just exposed all your passwords to bruteforcing attacks. Unless “hash” in this case is something like scrypt with sane parameters.

Originally (before I started writing my own password manager) I also thought that this is a safe method of password generation. And then I realized that it isn’t. Wrote about it here: https://palant.info/2016/04/20/security-considerations-for-p...

View on HN

Assuming you have the password and key, you'd need to brute force hash and masterPasswd. Seems hard.

It isn’t. You certainly used MD5, SHA1, SHA256 or SHA512 as hash, with SHA256 being the most likely one. All of these are very easy to bruteforce – if someone has one of your passwords, bruteforcing your master password won’t take all too long.

hash(x+const), hash^n(x), etc. are also hash functions.

Reply on news.ycombinator.com