How I salt my own passwords and sleep a little better at night
1–10 of 42 posts
Re: How I salt my own passwords and sleep a little better at night
#2This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack.
The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords.
It seems to me that a scheme like this would have to be much more complex, which unfortunately would just make it a pain to use.
I really wish Google, Mozilla, Microsoft, etc would step up and build a better authentication system right in to the browsers, perhaps with public key cryptography like SSH uses - then we'd have automatic logins to any site you decide to trust, and no more passwords.
Re: How I salt my own passwords and sleep a little better at night
#3I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then copy them off the screen.
Re: How I salt my own passwords and sleep a little better at night
#4This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords. It seems to me that a scheme like this would have to be muc…
in most password leak situations the issue is that you've used the same password elsewhere.. if it doesn't work, move on. It's unlikely you would be targeted specifically in such a situation.
Re: How I salt my own passwords and sleep a little better at night
#5This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords. It seems to me that a scheme like this would have to be muc…
>This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack.
It's not about storage, it is about how to get people to use different passwords. Arguably, the passwords are not very different, but what matters is that they are no longer identic
Its still good advice to people who use the same password on all their accounts. 'just prefix the password with the first three letters of the hostname' will make sure they're slightly better protected in case of a password leak.
Re: How I salt my own passwords and sleep a little better at night
#6This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords. It seems to me that a scheme like this would have to be muc…
It's definitely not a fool proof or airtight system, but it's going to be at least a little time consuming to figure out the mechanism. Sure, a concerted effort will still break it, but you can protect yourself a bit more from a "0-day" hack than the alternatives: same password everywhere.
We definitely need better authentication methods. For example, why couldn't Google open up their 2 factor authentication method? Why is it that my battle.net account can have better security than my bank account?
Frustrating!
Re: How I salt my own passwords and sleep a little better at night
#7This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords. It seems to me that a scheme like this would have to be muc…
>This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. It's not about storage, it is about how to get people to use different passwords. Arguably, the passwords are not very different, but what matters is that they are no longer identic Its still good advice to people who use the same password on all their accounts. 'jus…
We can all agree it's better than using the same password on every site, but the people who do this are very unlikely to adopt such a system.
Try explaining this to a small child or elderly person, it's just not going to work.
The technology to do away with passwords all together already exists, we just need the right people (lets face it, it's probably going to be google) to standardise and implement it. It's no easy job but in my opinion is necessary for the web to move forward.
Re: How I salt my own passwords and sleep a little better at night
#8I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then c…
Have you looked at http://supergenpass.com/ ? Sounds similar. There's a nice chrome extension and android app available for that algorithm.
Re: How I salt my own passwords and sleep a little better at night
#9This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack. The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords. It seems to me that a scheme like this would have to be muc…
mozilla is building browserid, while it does not get rid of passwords, it might be one spot where you can deply something like that. when integration within your browser happens, maybe we are not even far off...
Re: How I salt my own passwords and sleep a little better at night
#10I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then c…
Have you looked at http://supergenpass.com/ ? Sounds similar. There's a nice chrome extension and android app available for that algorithm.
it does not stretch and does not even use a serious hash (md5). it is also completely predictable how it builds its per-domain passwords. this will only work for very good master passwords. and even then it will disclose your master password after a while. (it doesn't help either that its example master password is 'snowflake'...)