Don't Store Passwords, Generate Them When Needed
1–10 of 64 posts
Re: Don't Store Passwords, Generate Them When Needed
#2How is remembering the pass-sentences different from remembering passwords?
Re: Don't Store Passwords, Generate Them When Needed
#3I'm confused. Can I get a real-world example out of this?
Re: Don't Store Passwords, Generate Them When Needed
#4However, this IS a master password only with a salted hash added on top. From the FAQ it uses a phrase like "Tubby loves tacos!facebook" runs it through SHA1 and spits out Facebook's password. Someone who shoulder surfs your keyphrase can now use this technique to generate passwords for any site, whereas using something like Password Safe or the various other password storage methods would need to both shoulder surf your master password as well as obtain your encrypted password file.
Re: Don't Store Passwords, Generate Them When Needed
#5How is remembering the pass-sentences different from remembering passwords?
Generally speaking, it's easier to remember a sentence that makes sense to you than an arcane sequence of letters, numbers, and symbols.
You can even this up, of course, with mnemonics and such, but a sentence like "I have got to get me one of THESE!" has less "mental entropy" than "aem1eePe{a".
Re: Don't Store Passwords, Generate Them When Needed
#6the encryption used to store passwords is rarely the problem, the strength of passwords and users remembering them is.
Re: Don't Store Passwords, Generate Them When Needed
#7I'm confused. Can I get a real-world example out of this?
I think the idea is that you remember a pass phrase, and the encryption type...at which point the program spits out a large hash string. The hash string gets used as your password wherever you need it, but all you need to remember is the pass phrase.
Re: Don't Store Passwords, Generate Them When Needed
#8How is remembering the pass-sentences different from remembering passwords?
Generally speaking, it's easier to remember a sentence that makes sense to you than an arcane sequence of letters, numbers, and symbols. You can even this up, of course, with mnemonics and such, but a sentence like "I have got to get me one of THESE!" has less "mental entropy" than "aem1eePe{a".
I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute-forcing your passphrase, not the password it generates.
I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, since you're led to believe these SHA1 passwords give you the same security as standard, locally-stored generated passwords.
Re: Don't Store Passwords, Generate Them When Needed
#9I have an application that includes a browser password manager and have been working on this problem on and off for a few years. First, there's nothing new being stated here. Second, password generation is marred by similar tradeoffs as any other approach to this subject. Third, after a lot of effort, I might go as far as to encourage people to re-use a single password for all but their most important sites. Fourth, statistically, I believe this is what 99% of the world does today, it does make some sense.
Re: Don't Store Passwords, Generate Them When Needed
#10This is a variant on hashapass.com