Toward Better Master Passwords

Re:Toward Better Master Passwords by shazow on Saturday June 25, 2011 @07:32PM (#2696921)

Like many who got bitten by Gawker, Sony, Mt.Gox and whoever else, I researched better alternatives. I found these options for password management utilities:

    - 1Password
    - KeePass
    - LastPass
    - PasswordGorilla
    - pwgen
    - pwsafe
    - SuperGenPassword

Here's my summary and comparison between the alternatives: https://github.com/shazow/everything/blob/master/research/pa...

[ Parent | on HN ]

Re:Toward Better Master Passwords by abrowne on Saturday June 25, 2011 @09:42PM (#2697146)

Nice summary. I wish I had seen it about a month ago when I spent an afternoon hunting through comments here and elsewhere looking for alternatives to 1Password. (No Linux or WebOS is my main issue.)

I see that you're using SuperGenPass. I loved and used the SGP bookmarklet for a while, but stopped when I read this article: "SuperGenPass is not that secure"[1]. Read the article, try the demo, then STOP USING THE BOOKMARKLET! Because of how the bookmarklet interacts with the page DOM, other scripts can read your password!

Now this doens't mean you have to stop using SGP. I still use it, mostly with the excellent Chrome extension (SuperGenPass for Google Chrome™ by Denis[2]) or the SPG mobile page[3] (which can be saved for offline use). Both of these compute the password without interacting with any other pages.

[1]: http://akibjorklund.com/2009/supergenpass-is-not-that-secure

[2]: https://chrome.google.com/webstore/detail/bmmmhbgdbpnbfefmac...

[3]: http://supergenpass.com/mobile/

[edited: typo, link formatting]

[ Parent | on HN ]

Re:Toward Better Master Passwords by shazow on Saturday June 25, 2011 @11:07PM (#2697262)

Thanks!

I agree, there are a few issues with SGP I would fix: It fails badly on Change Password forms, it uses ~10-iteration MD5 hashes which are easily-reversible today, and the default character set for the generated passwords is not great.

I feel I'm still in the "research" stage where I want to see if I can survive with using something like SGP. I'll definitely switch over to the extension from now, though.

Side note: It's probably not a terrible idea to still maintain multiple master passwords for really-important vs throw-away accounts.

[ Parent | on HN ]