Midnight project: Password manager without a password manager
1–10 of 43 posts
Re: Midnight project: Password manager without a password manager
#2You receive an email from a sheepish website owner admitting that your password has been compromised and asking you to change it. Now what do you do?
Re: Midnight project: Password manager without a password manager
#3You receive an email from a sheepish website owner admitting that your password has been compromised and asking you to change it. Now what do you do?
Add a counter. For a nice discussion on a few of the tradeoffs involved in such a system as this, see this thread:
http://www.mail-archive.com/cryptography@randombit.net/msg02...
So for this example, instead of:
(sha512sum ~/.salt - (sha512sum ~/.salt -(sha512sum ~/.salt -You can "rediscover" the correct password for a site, relatively easy by using this method -- iterating up to your current (correct) password. Another alternative might be using the year or month/year of last password change/set... all these methods have drawbacks -- but again see the thread for some interesting points on a similar system.
[edit: typo/formatting]
Re: Midnight project: Password manager without a password manager
#4This is fine for hackers but for mere mortals it looks cumbersome.
Re: Midnight project: Password manager without a password manager
#5Similar is https://www.pwdhash.com/
Re: Midnight project: Password manager without a password manager
#6This sounds similar to SuperGenPass, which I've used extensively since I heard about it.
Re: Midnight project: Password manager without a password manager
#7This is fine for hackers but for mere mortals it looks cumbersome.
Mortals simply use domainName+superSecretWord.
Re: Midnight project: Password manager without a password manager
#8One major problem with this scheme is that if someone steals (or subpoenas) your computer they can discover all your passwords just by looking at your shell history. A password manager that's secured by a strong password doesn't have that vulnerability.
Edit: As jroes pointed out below, this is not a problem.
Re: Midnight project: Password manager without a password manager
#9One major problem with this scheme is that if someone steals (or subpoenas) your computer they can discover all your passwords just by looking at your shell history. A password manager that's secured by a strong password doesn't have that vulnerability. Edit: As jroes pointed out below, this is not a problem.
They would only discover the domains, not the passwords you entered. You type the domain at the command line, but you type the password into stdin.
Re: Midnight project: Password manager without a password manager
#10Here's a little script that does something similar with some features that make it more useful (for hackers at any rate):