Skip to main content
Cryptography

Return to Answer

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

The approach you describe is very much like the approach that is used in the masterpassword app (http://masterpasswordapp.com/).

Roughly they generate a password for each site depending on:

  • Your master password
  • The site name
  • A number (so that if you have to change your password you can just increase the number)
  • Some salts that they decice.

And then they provide several formats in which to present the password, so that almost all sites will except one form or another.

As hash function they use a combination of SCrypt and SHA-256 (see also this questionthis question).

There are two downsides to this that I can see:

  1. You still have to find a way to remember your username for each site, as it stores nothing (you also have to remember the number and the site's name, but that should be doable).
  2. If you need to reset your master password, you have to reset ALL passwords.

Still, it's a good way to manage your passwords, as you don't have to rely on any 3rd party whatsoever (it's completely stateless), and there's pretty much nothing to backup (except maybe if you store the usernames and numbers elsewhere, but that is not critical information).

The approach you describe is very much like the approach that is used in the masterpassword app (http://masterpasswordapp.com/).

Roughly they generate a password for each site depending on:

  • Your master password
  • The site name
  • A number (so that if you have to change your password you can just increase the number)
  • Some salts that they decice.

And then they provide several formats in which to present the password, so that almost all sites will except one form or another.

As hash function they use a combination of SCrypt and SHA-256 (see also this question).

There are two downsides to this that I can see:

  1. You still have to find a way to remember your username for each site, as it stores nothing (you also have to remember the number and the site's name, but that should be doable).
  2. If you need to reset your master password, you have to reset ALL passwords.

Still, it's a good way to manage your passwords, as you don't have to rely on any 3rd party whatsoever (it's completely stateless), and there's pretty much nothing to backup (except maybe if you store the usernames and numbers elsewhere, but that is not critical information).

The approach you describe is very much like the approach that is used in the masterpassword app (http://masterpasswordapp.com/).

Roughly they generate a password for each site depending on:

  • Your master password
  • The site name
  • A number (so that if you have to change your password you can just increase the number)
  • Some salts that they decice.

And then they provide several formats in which to present the password, so that almost all sites will except one form or another.

As hash function they use a combination of SCrypt and SHA-256 (see also this question).

There are two downsides to this that I can see:

  1. You still have to find a way to remember your username for each site, as it stores nothing (you also have to remember the number and the site's name, but that should be doable).
  2. If you need to reset your master password, you have to reset ALL passwords.

Still, it's a good way to manage your passwords, as you don't have to rely on any 3rd party whatsoever (it's completely stateless), and there's pretty much nothing to backup (except maybe if you store the usernames and numbers elsewhere, but that is not critical information).

Source Link
Matty
Matty
  • 283
  • 3
  • 7

The approach you describe is very much like the approach that is used in the masterpassword app (http://masterpasswordapp.com/).

Roughly they generate a password for each site depending on:

  • Your master password
  • The site name
  • A number (so that if you have to change your password you can just increase the number)
  • Some salts that they decice.

And then they provide several formats in which to present the password, so that almost all sites will except one form or another.

As hash function they use a combination of SCrypt and SHA-256 (see also this question).

There are two downsides to this that I can see:

  1. You still have to find a way to remember your username for each site, as it stores nothing (you also have to remember the number and the site's name, but that should be doable).
  2. If you need to reset your master password, you have to reset ALL passwords.

Still, it's a good way to manage your passwords, as you don't have to rely on any 3rd party whatsoever (it's completely stateless), and there's pretty much nothing to backup (except maybe if you store the usernames and numbers elsewhere, but that is not critical information).