Show HN: NullPass, a stateless password manager written in JavaScript
1–10 of 18 posts
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#2Hi all, this is the first side project I've had that I've been happy enough to share with the world at large. I hope someone finds it useful and would be very eager for some feedback :) (Especially negative!)
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#3Is there a reason why you are using straight sha512 with concatenated elements instead of using a sha512 HMAC with the local password as the key to the HMAC?
http://en.wikipedia.org/wiki/Hash-based_message_authenticati...
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#4Is there a reason why you are using straight sha512 with concatenated elements instead of using a sha512 HMAC with the local password as the key to the HMAC? http://en.wikipedia.org/wiki/Hash-based_message_authenticati...
No, not really. I do like having the length concatenated inside as well, as this provides a unique password for different lengths (useful to quickly visually identify if a password looks 'right').
Is there any reason why HMAC would be better than my current implementation? I have had a read over the article and it seems that straight SHA512 should have similar cryptographic strength.
Thanks for your input!
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#5Is there a reason why you are using straight sha512 with concatenated elements instead of using a sha512 HMAC with the local password as the key to the HMAC? http://en.wikipedia.org/wiki/Hash-based_message_authenticati...
No, not really. I do like having the length concatenated inside as well, as this provides a unique password for different lengths (useful to quickly visually identify if a password looks 'right'). Is there any reason why HMAC would be better than my current implementation? I have had a read over the article and it seems that straight SHA512 should have similar cryptographic strength. Thanks for your input!
Read the "Design Principles" section more carefully. Simple concatenation suffers from several different attack vectors.
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#6Have you seen SuperGenPass? It's much the same concept, and has been around for years (including browser extensions, etc).
For the justifiably paranoid, a web service is not going to cut it (lack of https is just the start - relying on any web service is a _lot_ of trust to put in such an Important Thing). Even if you are as trustworthy as I'd hope, it's foolish to even allow the possibility of you (or your service) being compromised to affect the safety of my passwords.
Personally, I use a command-line implementation of SuperGenPass that a friend of mine wrote (and I host at github:gfxmonk/supergenpass). It avoids all sorts of spoofing / browser vulnerabilities, and is reasonably convenient with something like Guake.
I'm not trying to diss the concept at all - I love this kind of thing, and honestly can't understand why it isn't more widely used / encouraged. But It's worth pointing out what already exists in the space.
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#7I've been using PassHash "http://passhash.connorhd.co.uk/" for a while now and I really like it. If I understand your application correctly, PassHash does essentially the same thing as NullPass. I run PassHash using a local copy of PassHash so I don't have to worry about MITM attacks.
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#8Have you seen SuperGenPass? It's much the same concept, and has been around for years (including browser extensions, etc). http://supergenpass.com/ For the justifiably paranoid, a web service is not going to cut it (lack of https is just the start - relying on any web service is a _lot_ of trust to put in such an Important Thing). Even if you are as trustworthy as I'd hope, it's foolish to even allow the possibility…
Oh cool, I did some quick googling but hadn't come across supergenpass. I will have a better look at their implementation.
Thanks!
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#9I've been using PassHash " http://passhash.connorhd.co.uk/" for a while now and I really like it. If I understand your application correctly, PassHash does essentially the same thing as NullPass. I run PassHash using a local copy of PassHash so I don't have to worry about MITM attacks.
Looks identical to NullPass, I'll check it out.
Thanks for your input :)
Re: Show HN: NullPass, a stateless password manager written in JavaScript
#10Have you seen SuperGenPass? It's much the same concept, and has been around for years (including browser extensions, etc). http://supergenpass.com/ For the justifiably paranoid, a web service is not going to cut it (lack of https is just the start - relying on any web service is a _lot_ of trust to put in such an Important Thing). Even if you are as trustworthy as I'd hope, it's foolish to even allow the possibility…
SuperGenPass credits me as the originator of the idea, my page is still up at http://angel.net/~nic/passwd.html.
NullPass isn't a Web service, it's a one-page Javascript app like mine and SuperGenPass. But it loads a bunch of libraries, so it can't as easily be copied for safe offline or local use.