A while ago (12 years old), I recognized my passwords weren't safe at all. Because I used the very same password everywhere, some grumpy admin could easily take over all my accounts (he got mail and password).
The obvious thing to do is to change all passwords to unique new passwords. However, remembering these is cumbersome. There had to be a better way...
Leading to: Yet another password generator (Java >= 6).
- Non-storing password generation (no file containing all passwords)
- Easy recover of lost passwords
- Master password used only locally, therefore totally safe (I thought)
- Consistency across platforms (Android, Desktop, etc.)
- Configurable length of generated password
It works like this:
- Input master password and use of the password (e.g. google.com)
- Create a Sha1 SecureRandom object
- Seed it with the UTF-8 bytes of the master password and the use of the password
- Generate as many random alphanumeric characters as specified by the length slider
- How might this method of generating passwords be attacked (else than bruteforce)?
- How safe is this method of generating passwords?
- If it is unsafe, what causes this unsafety and how to improve it?
- Is there something entirely wrong with this approach?