Hacker News Reader

Comment by gibybo | Hacker News Reader

For those looking for something ultra lightweight, I highly recommend pwdhash (http://pwdhash.com). It's not a password manager, it's just an open source hashing algorithm that protects you from sites storing your password poorly. Instead of depending on them to store your password in a one-way hash, it does it on your end before sending the password to the site.

The algorithm is very roughly base64encode(hash(password + domain)), and then truncated to match your original password length.

The form on the site is just a demo (and backup if you need to use it outside of your own browser). What you really want is the extension (for most major browsers). You can type in the same strong password to every site and the extension will always hash it to the site specific password so you don't have to worry about them storing it poorly. You can also use unique master passwords for certain sites, if you so choose.

View on HN

I built something like this a while back* but with a slightly more complex algorithm to make it more difficult to find the master password from a set of hashes. I ended up ditching it in favor of KeePass mostly because if a site is hacked and your plaintext hash is compromised there isn't a clean way to generate a new password every time.

* https://github.com/goatslacker/hash

I used pwdhash for a long time, and moved to KeePass. pwdhash is less secure because:

* A site may be able to compromise the browser extension.

* You have to memorize several passwords because sites require different length passwords.

* The code has been reviewed less.

* A key-store like KeePass can store many original passwords, not just one hashed password.

* It doesn't have a non-browser app, so I had to copy paste passwords from the browser, while KeePass has Alt-Ctrl-A.

Oh nice, I've been thinking about something like this a lot lately. I don't really like the idea of truncating the generated password, though. I'd rather it use a proper KDF and fill the password field to its limit.

I think the reason they did it is because a lot of sites have maximum password lengths that would prevent the full output. Those are exactly the type of sites that you want to be using something like this on.

Sure, but as long as the site actually sets the password length limit on the field it shouldn't matter. It will obviously be truncated a lot of the time, but I'd rather it be truncated at thelongestpossible point.

From looking around it seems like the reason is that they wanted the visual representation of typing the password to reflect the number of characters you actually typed as you type them. I'm not sure if this comes out true, though, as I can't actually get it to work in chrome.

The chrome extensions requires putting '@@' at the start of the password field. This turns it yellow to indicate it is now active for that field.

>Sure, but as long as the site actually sets the password length limit on the field it shouldn't matter.

Yes, but in my experience sites rarely implement this. If they do, it's probably inconsistent (i.e. different limits on the login field, create account, and reset password fields).

Yep, tried that. Just doesn't do anything at all as far as I can tell. Maybe it has issues with linux chromium? I dunno.

Re password lengths, my experience is that they usually truncate on the server side at that point, rendering it pretty moot. But yes, I do see this problem. I'm just not sure you're not going to run into it either way if you're practicing good password hygiene. I'd still prefer it make an attempt at adding as much difficulty to the password as possible, though.

Reply on news.ycombinator.com