Hacker News Reader

Comment by timtadh | Hacker News Reader

I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then copy them off the screen.

https://github.com/timtadh/passmash

View on HN

Have you looked at http://supergenpass.com/ ? Sounds similar. There's a nice chrome extension and android app available for that algorithm.

it does not stretch and does not even use a serious hash (md5). it is also completely predictable how it builds its per-domain passwords. this will only work for very good master passwords. and even then it will disclose your master password after a while. (it doesn't help either that its example master password is 'snowflake'...)

pwdhash is a project out of stanford that wraps all this up into a browser extension. It just hashes your password with the domain you're logging into.

https://www.pwdhash.com/

the paper: http://crypto.stanford.edu/PwdHash/pwdhash.pdf

wow thats so cool. for a long time now, i've been looking for a solution. i tried keepass, but it doesn't really work well in linux, and i don't have my passwords on other computers.

then i tried lastpass, but i don't like the idea of my passwords beeing stored somewhere else (even though they are encrypted).

this sounds like a solid solution to the easy-to-remember but different-password-for-each-site problem. definitely gonna give it a try.

i tried keepass, but it doesn't really work well in linux

The integration might be less than for Windows and OS X. It works great for me on those systems, though.

i don't have my passwords on other computers.

I just keep a KeePass file in Dropbox. I also have a KeePass app on my phone.

> i tried keepass, but it doesn't really work well in linux,

Try KeePassX http://www.keepassx.org/ which works really well in Linux. It even has a hot key to push username and password into the appropriate fields in the browser.

I installed it a week or so ago (after trying others) and am pretty impressed so far.

this is perfect, thanks for the tip

Edit: I notice it uses MD5 though. Question: how secure would this kind of system be with bcrypt and an OS X Password Assistant "memorable" 12 char password?

Reply on news.ycombinator.com