21–30 of 42 posts
Dude, just use bcrypt, no need to reinvent the wheel
Dude, read the article (the title is misleading). He is talking about creating a password that he can memorize, not about encrypting his password.
This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords. It seems to me that a scheme like this would have to be muc…
>This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. It's not about storage, it is about how to get people to use different passwords. Arguably, the passwords are not very different, but what matters is that they are no longer identic Its still good advice to people who use the same password on all their accounts. 'jus…
I just changed all my passwords so they're prefixed with 'www' but I'm not sure how that will help make them more secure. (j/k)
Why not use a password manager? You only need one password and don't have to do salt tricks. There are even password managers with 2-factor login. Unique strong passwords for each site auto filled. Super easy.
Came across this forum that you last visited 7 years ago? Remember the password? With this technique you will, without resorting to password managers - and still have a unique password on every site.
Remember not to make your salt obvious though. In other words don't just append the domain name in front of the password or it will be quite worthless. Instead take for instance the third letter in your password and let it be the second-to-last letter in the domain name (and do some further transformations), and you're good to go. You will remember the specific password for sites you go to often but for any site you will be able to "re-generate" the password in your head.
Why not use a password manager? You only need one password and don't have to do salt tricks. There are even password managers with 2-factor login. Unique strong passwords for each site auto filled. Super easy.
Because most of us want to be able to use any device in the world without relying on any third party to login to a certain website.
This is not good protection against a targeted effort -- when somebody wants to get your account as opposed to any account, when they have one instance of a "salted" password they might be able to reverse-engineer your salting effort and apply it to another site. And they don't have to completely reverse it, either, it might be enough to significantly reduce the difficulty of brute force. But it sure beats using an i…
I'm using a free password manager (KeePassX) with the file hosted on Dropbox for a couple of years now. I've not had any major trouble with it.
People might like to note, though, that my 16 character randomly password (lowercase letters and numbers for over 128 bits of entropy) was still cracked during the LinkedIn incident. I'm switching to 24 character passwords now.
Earlier quoted context omitted.
pwdhash is a project out of stanford that wraps all this up into a browser extension. It just hashes your password with the domain you're logging into. https://www.pwdhash.com/ the paper: http://crypto.stanford.edu/PwdHash/pwdhash.pdf
wow thats so cool. for a long time now, i've been looking for a solution. i tried keepass, but it doesn't really work well in linux, and i don't have my passwords on other computers. then i tried lastpass, but i don't like the idea of my passwords beeing stored somewhere else (even though they are encrypted). this sounds like a solid solution to the easy-to-remember but different-password-for-each-site problem. defin…
The integration might be less than for Windows and OS X. It works great for me on those systems, though.
i don't have my passwords on other computers.
I just keep a KeePass file in Dropbox. I also have a KeePass app on my phone.
OK, so with that out of the way, let's say you've chosen a weak (and common) password. If people start using this self-salting scheme, it's a fair bet someone else that will use the same self-salt as you, and that means two identical hashes in the database. That's bad news.
But it's also easy to fix. Simply choose some fixed salt to also add to your password. It could be the first two letters of your username, for example. That way, if "bobmarley" and "jackblack" both have the password "champagne" and both used the first four letters of the website for their salt, then on linked in one will be "linkbochampagne" and the other will be "linkjachampagne", and they can rest knowing that it's very unlikely that their password will hash the same as someone else's.