11–20 of 47 posts
I think this is in an incredibly bad way to create passwords, at any given moment they could swap out the js so that it phones home and then boom your insecure.
Why not just use the phrase+password as a password?
Why not just use the phrase+password as a password?
I glanced over the JS source and didn't find any evidence that the site is malware. Unfortunately, that's about the best thing I have to say about the security of using this method.
What are some negatives to using a security method like this? In my mind, it's just a way to come up with "hard to guess, but easy to remember" passwords.
2. The cipher used is laughably weak. Given a sufficiently large output string (and sufficiently large is not large at all), it's trivial to brute-force the seed used to generate the substitution chart and determine the input password.
3. See my other comment on MITM attacks.
I think this is in an incredibly bad way to create passwords, at any given moment they could swap out the js so that it phones home and then boom your insecure.
It's incredibly simple to save the JS files + HTML file to your local machine and run it locally.
I can't imagine actually getting people to remember (and enter) strings like p?7J9JJ4M^E97J*J7J into a password field.
Or am I using it incorrectly?
Earlier quoted context omitted.
> even looks like it's in JS to prevent most MitM attacks! The JS is delivered over cleartext HTTP. A MITM attack can substitute malicious JS code that will deliver your password to a third-party server.
Not if you just save the JS file to your local machine, right? There's no HTTP involved in that case (which is precisely how I intended to use it).
Wow! I've actually been trying to come up with a secure, but easy-for-me-to-remember password scheme. What I wanted to build was a password generator which takes a username and domain as inputs and spits out an pseudo-random passsword. Something like: bgraves & ycombinator.com & salt = ybcgormabviensator#salt The problem for me is that I use very hard to guess passwords, generated by my password database program (Kee…
Why not just use the phrase+password as a password?
Because that doesn't give you security if the site is compromised. For example, if my Phase+password combination is RootGod+Facebook.com it wouldn't take very long for someone to realize that RootGod+Gmail.com would also likely work there.