Tag Info

Hot answers tagged

15

One problem with this kind of solution where a predictable algorithm is used to generate a secret from a master password/phrase, is that if your master password is compromised directly (e.g. keylogger) or indirectly (e.g. an attacker with a password of yours generated through this system who can carry out a brute-force attack on it), the attacker has ...


10

The normal mechanism for a password manager is to have some sort of "master key" and encrypt the data (symmetrically) with that key. The master key, in your case, being derived from the master password through proper password hashing (so it becomes, in this case, password-based key derivation). So use bcrypt or PBKDF2 to turn the user's master password into ...


7

In short, this method provides no additional security over a regular password manager, and makes it impossible to change your password for a single, specific service. For instance, you mentioned the example of malware using a keylogger to get your master password and then compromising all the passwords in your password file. Your proposed scheme provides no ...


5

What you're thinking of has been done quite a few times already. Here's an example: http://plevyak.com/dpg.html It's called a Deterministic Password Generator, meaning it creates passwords based on other information that you enter. Just like you said, using your master password, some other information, and the name of the site.


4

Couple points about the question, too long for a comment, some stuff has already been mentioned separately: has been done lots of times, there are tools available from one leaked password the other passwords could in theory be compromised if someone guesses how and what you are hashing to get the passwords and then uses brute-force. Still much better than ...


4

The details of how Google implemented this functionality is unknown and proprietary to google so it isn't possible to answer your question completely. However, here are the high points: Google will have to save your POP3 account password in their system. There is no way around this because POP3 has no is no standard way to delegate rights to a third-party ...


2

What you're looking for sounds like Privileged Access Management - a central database that stores administrative and other non-user credentials and allows authorized users to "check them out" for use. Such systems often will programmatically change the credentials on the target system so as to prevent re-use outside the window for which access was granted. ...


1

See this for an introduction on password hashing. That your method ("sha1(password + md5(login))") may be guessed by the attacker is not a problem. Well, it is an indirect problem. Ideally, a "secret algorithm" would protect you even if the said secret algorithm was abysmally weak, because the attacker would still do not know the ends or tails of what you ...


1

Forgot about this…so here is how I done it. First off I used google academic to find papers on last pass, password managers and memory forensics. It was the last one I found to be more helpful Amari, K. (2009) Techniques and Tools for Recovering and Analysing Data from Volatile Memory. After gaining an understanding memory extracting and analysis I ...


1

Look at SQRL for a system that replaces a "password manager" with somethings that works without needing a central DB and can defeat the keyloggers as well. The web servers that you visit will not require secret state about you (like a password) with this system. The id that is provided to each website is unique for each website, so an id token from one site ...


1

Normally the user needs to authenticate first in order to see the password change form. By entering the user name and password, the system should first authenticate the user and once authentication is successful, the password should be changed. This is something that can't be verified using the example URL you gave. However, in this case I would ...



Only top voted, non community-wiki answers of a minimum length are eligible