Live data from Hacker News

How I salt my own passwords and sleep a little better at night

peebs.org

41–42 of 42 posts

Re: How I salt my own passwords and sleep a little better at night

#41

Earlier quoted context omitted.

pwdhash is a project out of stanford that wraps all this up into a browser extension. It just hashes your password with the domain you're logging into. https://www.pwdhash.com/ the paper: http://crypto.stanford.edu/PwdHash/pwdhash.pdf

wow thats so cool. for a long time now, i've been looking for a solution. i tried keepass, but it doesn't really work well in linux, and i don't have my passwords on other computers. then i tried lastpass, but i don't like the idea of my passwords beeing stored somewhere else (even though they are encrypted). this sounds like a solid solution to the easy-to-remember but different-password-for-each-site problem. defin…

> i tried keepass, but it doesn't really work well in linux,

Try KeePassX http://www.keepassx.org/ which works really well in Linux. It even has a hot key to push username and password into the appropriate fields in the browser.

I installed it a week or so ago (after trying others) and am pretty impressed so far.

Re: How I salt my own passwords and sleep a little better at night

#42
post #19

Use five random words from diceware.com to create a password, and you will have 65 bits of strength. No more tossing and turning.

That's good advice but it doesn't protect you from your password having the same hash on multiple sites.

If you use a distinct random passphrase on each site, they are virtually guaranteed not to hash to the same value under any hashing scheme. What obvious point am I missing here?
Post reply on HN