2
$\begingroup$

I am considering creating an application that is able to work out a unique password for a site by hashing the url while using a secure master password as a salt (or technically pepper since it will always be the same?). I am incredibly inexperienced in the world of cryptology so if this is a stupid question then sorry for wasting your time (:

$\endgroup$
  • $\begingroup$ Turn it around and you can see this as a password hash where the password is used as input key material and the site is the salt. I would suggest this is the better way of looking at it. $\endgroup$ – Maarten Bodewes Nov 20 '18 at 16:12
1
$\begingroup$

The aim of using salt is having a countermeasure against the Rainbow tables. In your case, we can think of as you are creating a password for each site by using a master password and the URL of the site as salt.

Normally, you will be secure against the rainbow tables. One, however, must consider the case that the master password is compromised. Then all of the sites are easily compromised since your URL is known and the hash algorithm is also known.

A better solution, first, use an off-line system to generate the password for each site using a KDF function ( as Bcrypt, Argon2, PBKDF2) using your master password. For the randomness in KDFs you can use the URL but add other random values, too. Now, save your master password as offline, or delete if you finished.

Then you can use these passwords directly. And, remember you will still need the salt and pepper in your websites against rainbow tables.

$\endgroup$
  • 3
    $\begingroup$ There has been a lot of discussion about such schemes. The fact that you still rely on one master password - that cannot be easily changed, the fact that you cannot change the used passwords for the sites easily and similar issues are major drawbacks of this scheme. Often it is better to simply use a protected / encrypted password database - preferably on a different device. $\endgroup$ – Maarten Bodewes Nov 20 '18 at 16:15
  • $\begingroup$ @MaartenBodewes I agree with you about relying on a master, it is like endless rely. I would still prefer to use the password database as an off-line system. $\endgroup$ – kelalaka Nov 20 '18 at 16:54
  • $\begingroup$ Thank you very much for your answer kelalaka and for your comments @MaartenBodewes. The reason I want to use a system such as this one is because there is no chance of loosing the passwords if I loose the device they are stored on and they do not need to be synced between devices since the password application on any device will be able to determine the password given my master password. Additionally if the devices I use to obtain the passwords are out of charge and I am on a public computer I would still be able to obtain the password. $\endgroup$ – Henry Howeson Nov 20 '18 at 17:01
  • $\begingroup$ Since my accounts are not particularly sought after, being a fairly average person, I suspect the main threat to my security will be brute force attacks or site wide hacks, the chances of anyone determining the master password are very small since it would not be stored anywhere except in my head. If i simply incremented an additional number at the end of the salt every time I needed to change the password due to a hack or similar then that would generate a completely new hash to use as my new password. I could then have my application try incrementing the number on the end till it works. $\endgroup$ – Henry Howeson Nov 20 '18 at 17:08
  • $\begingroup$ @HenryHoweson It is not a good idea to use a public computer to manage your sites. $\endgroup$ – kelalaka Nov 20 '18 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.