One way to fix your rubbish password database • Hacker News Board

Re: One way to fix your rubbish password database

#91

Post by StavrosK » Sun, Jun 10, 2012, 7:48 PM UTC

icebraining wrote: post #50

StavrosK wrote: post #45

Earlier quoted context omitted.

Ah, I hadn't considered that... That's a shame...

Just wanted to point out that any implementation as a browser extension (as opposed to bookmarklet) is safe from DOM manipulation; searching on Google for "supergenpass extension" returns results for at least Chrome, Firefox and Opera.

I'm not so sure, the extension still appends DOM elements, I'm sure those are just as susceptible to sniffing...

Re: One way to fix your rubbish password database

#92

Post by simonbrown » Sun, Jun 10, 2012, 8:31 PM UTC

StavrosK wrote: post #91

icebraining wrote: post #50

Earlier quoted context omitted.

Just wanted to point out that any implementation as a browser extension (as opposed to bookmarklet) is safe from DOM manipulation; searching on Google for "supergenpass extension" returns results for at least Chrome, Firefox and Opera.

I'm not so sure, the extension still appends DOM elements, I'm sure those are just as susceptible to sniffing...

I haven't looked at the code or even used it that much, but it seems like it only uses content scripts to insert the password into the field, and everything else is dealt with by the popup/background page, which websites don't have access to.

Re: One way to fix your rubbish password database

#93

Post by cheatercheater » Mon, Jun 11, 2012, 3:36 PM UTC

tptacek wrote: post #89

cheatercheater wrote: post #86

Earlier quoted context omitted.

Red light coming up in the back of my head. Wouldn't the MD5->scrypt pipeline expose new attacks that scrypt doesn't have? Maybe there's a higher collision probability or some known-text attack, but I'm really shooting in the dark here.

No.

That's one person whose "no" I'll accept without further explanations. Thanks for clarifying.

Re: One way to fix your rubbish password database

#94

Post by [deleted] » Mon, Jun 11, 2012, 3:36 PM UTC

tptacek wrote: post #89

cheatercheater wrote: post #86

Earlier quoted context omitted.

Red light coming up in the back of my head. Wouldn't the MD5->scrypt pipeline expose new attacks that scrypt doesn't have? Maybe there's a higher collision probability or some known-text attack, but I'm really shooting in the dark here.

No.

[deleted]