Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Midnight project: Password manager without a password manager

gist.github.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Midnight project: Password manager without a password manager

#11

Post by antimora »

This approach is cryptographically WEAKER than a password manager!

Because password[0], password[1], ... password[n] are all related through common salt and master password string (and known domain name). Where as passwords stored in a password managers are independent.

Therefore, in theory, if I know a few of your passwords (lets say I own 10 top domains and you've got accounts with me), I can crack your salt and password file, or at least, I can generate probable passwords for other domains.

Re: Midnight project: Password manager without a password manager

#14

Post by randomtyler »

aiiane wrote: post #13
jhawthorn wrote: post #5

Similar is https://www.pwdhash.com/

Also http://passwordmaker.org/

This /is/ PasswordMaker in infancy. I was a PasswordMaker user for a 3 or 4 years until the project stopped getting updates and they couldn't (or wouldn't) support Chrome.

Re: Midnight project: Password manager without a password manager

#15

Post by cwp »

antimora wrote: post #11

This approach is cryptographically WEAKER than a password manager! Because password[0], password[1], ... password[n] are all related through common salt and master password string (and known domain name). Where as passwords stored in a password managers are independent. Therefore, in theory, if I know a few of your passwords (lets say I own 10 top domains and you've got accounts with me), I can crack your salt and pa…

Also, the advantage of not having to keep your password database secret is negated by problem of keeping your salt file secret.

Re: Midnight project: Password manager without a password manager

#16

Post by jroes »

jayfuerstenberg wrote: post #4

This is fine for hackers but for mere mortals it looks cumbersome.

Yeah, I really like the idea, but there's no way I'm going to run all that stuff at the command line every time I need to generate a password.

So, I wrote a gem:

http://github.com/jroes/passwordy

Re: Midnight project: Password manager without a password manager

#17

Post by jroes »

antimora wrote: post #11

This approach is cryptographically WEAKER than a password manager! Because password[0], password[1], ... password[n] are all related through common salt and master password string (and known domain name). Where as passwords stored in a password managers are independent. Therefore, in theory, if I know a few of your passwords (lets say I own 10 top domains and you've got accounts with me), I can crack your salt and pa…

Is this cost offset in comparison to passwords actually being stored in a password manager? Do we know if all password managers are written in such a way that they generate independent salts per password?

What is the likelihood that you own or would have compromised 10 top domains? Not sure if that matters, just curious.

At the very least I'd personally prefer to use an open, understandable methodology to generate my passwords than some of the more popular options that are secured through obscurity.

Re: Midnight project: Password manager without a password manager

#18

Post by bascule »

antimora wrote: post #11

This approach is cryptographically WEAKER than a password manager! Because password[0], password[1], ... password[n] are all related through common salt and master password string (and known domain name). Where as passwords stored in a password managers are independent. Therefore, in theory, if I know a few of your passwords (lets say I own 10 top domains and you've got accounts with me), I can crack your salt and pa…

The difference between the output of SHA512 and random data is negligible, provided that the master password is of non-negligible entropy. This is a necessary property of a secure hash function. HMAC or HKDF would probably be more appropriate here, but this usage is not inherently insecure.

I'd certainly love to see you try to recover the master password from only 10 hashes.

Re: Midnight project: Password manager without a password manager

#19

Post by MTGandP »

jroes wrote: post #9
greenyoda wrote: post #8

One major problem with this scheme is that if someone steals (or subpoenas) your computer they can discover all your passwords just by looking at your shell history. A password manager that's secured by a strong password doesn't have that vulnerability. Edit: As jroes pointed out below, this is not a problem.

They would only discover the domains, not the passwords you entered. You type the domain at the command line, but you type the password into stdin.

The program outputs your site-specific password to stdout. Is it possible for an attacker to get your stdout history?

Re: Midnight project: Password manager without a password manager

#20

Post by kwanbis »

randomtyler wrote: post #14
aiiane wrote: post #13

Earlier quoted context omitted.

Also http://passwordmaker.org/

This /is/ PasswordMaker in infancy. I was a PasswordMaker user for a 3 or 4 years until the project stopped getting updates and they couldn't (or wouldn't) support Chrome.

There is PasswordMaker Pro on Chrome. I use it along PasswordMaker for Firefox and both generate the same password.
Post reply on HN