Hacker News Reader

Comment by maneesh | Hacker News Reader

I use SuperGenPass, which hashes the domain of a website with a Master password, so you only need to remember one password. Then, every time you log in, you just enter in your master password, it automatically hashes it, and you get a new password for logging in like af49AgsdU8

EDIT: here's the link http://www.supergenpass.com/

View on HN

This scheme is hugely flawed.

If you steal a password list from a website you can identify all the passwords generated by this utility (10 characters, uniform distribution over alphanumeric characters) and then simply crack the master passwords with a brute force attack. If you have stolen multiple SuperGenPass generated passwords from the same website, you can crack them all at the same time with no additional penalty. After recovering the master password you can then log into every single online account belonging to the user.

They seem to generate the password hash with simple md5, which is about the worst possible choice they could have made. Any master password which is low entropy enough to carry around in your brain can probably be cracked in a few days at most.

Except that you don't use the full MD5 sum, so it's not a simple matter of brute-forcing it.

For the default password length of 10 characters they use ~60 bits of MD5 output. That's more than enough information to uniquely identify the master password.

So once your master password is found (brute force/keylogger/shoulder surfing), the attacker has a handy bookmarklet to log into all of your accounts.

Amen. It amazes me how little this has caught on with the technical people I know. You can have your cake and eat it too: you only need to remember a single password, but you get to keep that password private. And you can use as many different computers and browsers as you want.

I've also been using this for ages. Absolute huge time saver. I used to keep vim encrypted files for every site I visited...when the list topped about three hundred, it seemed like time for a change.

Holy crap, how have I not heard of this?!

I love 1Password, but I wish they supported Opera. I would almost switch to this if it weren't for the need to reset hundreds of passwords.

I know! Where's the news on this been? This sounds awesome - more research, but I'm seriously thinking about switching.

Reply on news.ycombinator.com