Dude, just use bcrypt, no need to reinvent the wheel
How I salt my own passwords and sleep a little better at night
11–20 of 42 posts
Re: How I salt my own passwords and sleep a little better at night
#12I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then c…
pwdhash is a project out of stanford that wraps all this up into a browser extension. It just hashes your password with the domain you're logging into.
Re: How I salt my own passwords and sleep a little better at night
#13if your password handling affects your sleep, you need a more rigorous solution than a little piece of software.
Re: How I salt my own passwords and sleep a little better at night
#14This is not good protection against a targeted effort -- when somebody wants to get your account as opposed to any account, when they have one instance of a "salted" password they might be able to reverse-engineer your salting effort and apply it to another site. And they don't have to completely reverse it, either, it might be enough to significantly reduce the difficulty of brute force.
But it sure beats using an identical password everywhere, and it does have the one major (and massive) advantage of using an identical password on n sites: you only have to remember O(1) things as opposed to O(n). And it can still be done completely in your head, as opposed to other schemes ("real" hashing schemes, password managers) which may introduce their own invulnerabilities or will lock you out from accounts on other computers.
Re: How I salt my own passwords and sleep a little better at night
#15This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords. It seems to me that a scheme like this would have to be muc…
If you make your password somewhat longer, it gets exponentially harder to crack.
Re: How I salt my own passwords and sleep a little better at night
#16I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then c…
pwdhash is a project out of stanford that wraps all this up into a browser extension. It just hashes your password with the domain you're logging into. https://www.pwdhash.com/ the paper: http://crypto.stanford.edu/PwdHash/pwdhash.pdf
wow thats so cool. for a long time now, i've been looking for a solution. i tried keepass, but it doesn't really work well in linux, and i don't have my passwords on other computers.
then i tried lastpass, but i don't like the idea of my passwords beeing stored somewhere else (even though they are encrypted).
this sounds like a solid solution to the easy-to-remember but different-password-for-each-site problem. definitely gonna give it a try.
Re: How I salt my own passwords and sleep a little better at night
#17I don't do anything of the sort and not only do I sleep fine at night, I don't have to go through some ridiculous ritual 100 times per day just to log in to a web site.
Re: How I salt my own passwords and sleep a little better at night
#18I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then c…
pwdhash is a project out of stanford that wraps all this up into a browser extension. It just hashes your password with the domain you're logging into. https://www.pwdhash.com/ the paper: http://crypto.stanford.edu/PwdHash/pwdhash.pdf
this is perfect, thanks for the tip
Edit: I notice it uses MD5 though. Question: how secure would this kind of system be with bcrypt and an OS X Password Assistant "memorable" 12 char password?
Re: How I salt my own passwords and sleep a little better at night
#19Use five random words from diceware.com to create a password, and you will have 65 bits of strength. No more tossing and turning.
Re: How I salt my own passwords and sleep a little better at night
#20Dude, just use bcrypt, no need to reinvent the wheel
Dude, read the article (the title is misleading). He is talking about creating a password that he can memorize, not about encrypting his password.