Also, this is yet another privacy threat that I dodged because I use the PwdHash extension (https://www.pwdhash.com/). You type the same password for all sites, but the extension invisibly uniquifies them on a per-site basis.
Doesn't seem like a good fit for the paranoid. If you screw up and your master password leaks, an attacker can access all of your accounts.
I greatly prefer KeePass + Dropbox, which also lets you securely store usernames and notes. And the passwords are random and not derived from anything.
While it's not a perfect solution, most of the time you are not trying to protect yourself from a dedicated, thinking, hacker. Instead you're protecting yourself against automated systems that share passwords. Unless it was commonplace it would avoid a majority of those issues.
Agreed. But OTOH it's a very lightweight solution, which is an advantage. And in any case, it's MUCH better than using the same unhashed password everywhere.
I'm claiming that using PwdHash is strictly better than not using it. YMMV.
To be honest, that looks like it has a some drawbacks when used with different domains that use the same authentication backend.
Think Google's different domains (google.com, google.co.uk, google.nl, gmail.com etc.) The demo gives a different hashed password whenever the TLD differs. And seeing that Google by default redirects you to the homepage of whatever country you're in at the moment, you might end up getting burned by the extension when travelling.
The problem of sharing passwords across domains is one of the things that prompted me to write the password-generating service Cryptasia [1].
In short, Cryptasia uses a Google Spreadsheet entirely owned & controlled by each user as a 3rd party data store. Each row contains the friendly name of the site, the login URL, the password generation key, a list of allowed characters, which characters are required, and the length of the password to create. By using the same generator key and character sets, one can have the same password for multiple websites. The password can also be changed for a website without having to change your master passphrase, since just changing the generator key (say, adding a "1" afterward) completely changes the created password.
I know it's not as easy to use as a browser extension, but when I visited Europe it was nice to be able to hop on any computer in one of the hotels and check my email.
I can throw this on Github if anyone's interested (the source-code is all in unobscured JS, too).
> you might end up getting burned by the extension when travelling.
Good point. This could happen. I'm assuming by "burned" you mean "unable to login". If so, you can always type in your home country's domain into the webapp version and get the correct hashed password. I agree this isn't ideal. Just saying that there's a plan B.
Comments
Amazing.
Also, this is yet another privacy threat that I dodged because I use the PwdHash extension (https://www.pwdhash.com/). You type the same password for all sites, but the extension invisibly uniquifies them on a per-site basis.
Doesn't seem like a good fit for the paranoid. If you screw up and your master password leaks, an attacker can access all of your accounts.
I greatly prefer KeePass + Dropbox, which also lets you securely store usernames and notes. And the passwords are random and not derived from anything.
While it's not a perfect solution, most of the time you are not trying to protect yourself from a dedicated, thinking, hacker. Instead you're protecting yourself against automated systems that share passwords. Unless it was commonplace it would avoid a majority of those issues.
> Doesn't seem like a good fit for the paranoid.
Agreed. But OTOH it's a very lightweight solution, which is an advantage. And in any case, it's MUCH better than using the same unhashed password everywhere.
I'm claiming that using PwdHash is strictly better than not using it. YMMV.
Shameless plug -- Pass: The Standard Unix Password Manager
http://zx2c4.com/projects/password-store/
It works damn well.
To be honest, that looks like it has a some drawbacks when used with different domains that use the same authentication backend.
Think Google's different domains (google.com, google.co.uk, google.nl, gmail.com etc.) The demo gives a different hashed password whenever the TLD differs. And seeing that Google by default redirects you to the homepage of whatever country you're in at the moment, you might end up getting burned by the extension when travelling.
The problem of sharing passwords across domains is one of the things that prompted me to write the password-generating service Cryptasia [1].
In short, Cryptasia uses a Google Spreadsheet entirely owned & controlled by each user as a 3rd party data store. Each row contains the friendly name of the site, the login URL, the password generation key, a list of allowed characters, which characters are required, and the length of the password to create. By using the same generator key and character sets, one can have the same password for multiple websites. The password can also be changed for a website without having to change your master passphrase, since just changing the generator key (say, adding a "1" afterward) completely changes the created password.
I know it's not as easy to use as a browser extension, but when I visited Europe it was nice to be able to hop on any computer in one of the hotels and check my email.
I can throw this on Github if anyone's interested (the source-code is all in unobscured JS, too).
[1] crypt.asia or http://www.cryptasia.com
> you might end up getting burned by the extension when travelling.
Good point. This could happen. I'm assuming by "burned" you mean "unable to login". If so, you can always type in your home country's domain into the webapp version and get the correct hashed password. I agree this isn't ideal. Just saying that there's a plan B.