Hacker News Reader

Comment by crcastle | Hacker News Reader

Something like this? https://www.pwdhash.com/ You can use the same password but the local browser plugin will use the site's URL to hash the password you type into something unique to that URL. I haven't used it personally and haven't researched it in detail but I like the concept.

View on HN

Sounds like supergenpass which was implemented in Javascript as a bookmarklet, which is pretty good idea, except that any website with malicious code could grab your master pass from the DOM, and then they could use that for your account on any other website.

It looks like pwdhash works around this by functioning as a browser plugin (making your master password in accessible from the DOM) but I'd still be slightly worried about browser exploits allowing malicious sites to get at your master password.

It's remarkably hard to get this right. pwdhash notes[1] that being a browser plugin stops JavaScript grabbing the password, but it's still possible with Flash. Third-party ports to other browsers don't even have the JS protection.

pwdhash still leaks the length of the password since it aims to give users visual feedback of characters being typed.

Then you've also got the issue of automatic update of plugins being compromised. The question is really: is it more secure than the alternatives?

1: http://crypto.stanford.edu/PwdHash/pwdhash.pdf

Maybe you use trust-level master passwords. E.g.

Financial institutions you type in: 'myfinancialpassword' Other sites you type: 'myrelativelysecurepassword'

Reply on news.ycombinator.com