Show HN: A simple “stateless” password manager for Chrome
stephanboyer.com
Show HN: A simple “stateless” password manager for Chrome
1–10 of 54 posts
Re: Show HN: A simple “stateless” password manager for Chrome
#2Ok, the idea in general isn't good because most people won't use a good password and also because now there's a single point of failure if someone sees your password.
However, it might be okay if one can provide their own hashing function. Like a JS function that takes the domain and secret key as parameters.
Re: Show HN: A simple “stateless” password manager for Chrome
#3I've been using SuperGenPass for this for years. There is a Chrome extension that is safe (from website snooping of your key) and a browser bookmarklet that is not safe. But, I just use the mobile browser version in another tab and copy paste since I choose to use Firefox. It's a little less convenient, but not inconvenient enough that I've spent time trying to figure out how to make a safe extension for Firefox.
So, what's different about this from the SuperGenPass session Chrome plugin?
Re: Show HN: A simple “stateless” password manager for Chrome
#4Why do 2^16 rounds of a designed-to-be-fast SHA-256 when there are deliberately slow PBKDF, such as scrypt?
Re: Show HN: A simple “stateless” password manager for Chrome
#5Ok, the idea in general isn't good because most people won't use a good password and also because now there's a single point of failure if someone sees your password. However, it might be okay if one can provide their own hashing function. Like a JS function that takes the domain and secret key as parameters.
This is a technique that's been in use for about a decade (in GenPass and SuperGenpass). There are, in fact, flaws in an all JavaScript bookmarklet solution, as the site you're visiting can snoop your JavaScript data structures and could readily figure out your master password. This is resolved by use of a Google extension that does not share a JavaScript interpreter with the page you're visiting; and it's reportedly been fixed in the bookmarklet version of SuperGenPass though I haven't read it to see how it is resolved.
But, your suggestion of a JS function that take the domain and secret key is how the GenPass and SuperGenPass bookmarklets have worked for years (and the flaw in that method has only been fixed this year, I think).
Re: Show HN: A simple “stateless” password manager for Chrome
#6Ok, the idea in general isn't good because most people won't use a good password and also because now there's a single point of failure if someone sees your password. However, it might be okay if one can provide their own hashing function. Like a JS function that takes the domain and secret key as parameters.
It's still a huge step up from the all-too-common "use the same password everywhere" technique.
Re: Show HN: A simple “stateless” password manager for Chrome
#7Use slower / heavier hash -- PBKDF2 or better. For lulz use something like Darkcoin Cryptocurrency 'X11' Proof of Work function - multiple rounds of 11 different hashes.
Or more. (X13, X15 and X17 all exist as PoW functions in CryptoCurrencies today).
A <$1000 bitcoin (SHA-256) mining ASIC appliance is likely to be doing 1TH/s. Makes 2^16 rounds look kinda weak.
Re: Show HN: A simple “stateless” password manager for Chrome
#8This is awesome. Minimal and elegant.
Re: Show HN: A simple “stateless” password manager for Chrome
#9Please tell me I am missing something. There is no salt. The hashing algorithm is hence vulnerable to a simple dictionary attack. It does not matter if you do a gigazillion rounds. Someone can still pre-calculate a list of common passwords and then test that list against each and every user.
Re: Show HN: A simple “stateless” password manager for Chrome
#10Please tell me I am missing something. There is no salt. The hashing algorithm is hence vulnerable to a simple dictionary attack. It does not matter if you do a gigazillion rounds. Someone can still pre-calculate a list of common passwords and then test that list against each and every user.
Agreed, it would be nice to just include your email/login as a salt.