News for hackers. Stuff that matters.

A comment on Simplified Sign-Up and Log-In Flows. Parent comment

Re:Simplified Sign-Up and Log-In Flows by cpeterso on Wednesday February 15, 2012 @10:28AM (#3594554)
I use SuperGenPass, a password-generating bookmarklet. Instead of storing your passwords (locally or on a server), SuperGenPass generates a strong, site-specific password by hashing your master password and the site's hostname. I remember just one master password, but no site has the same password in their database.

The problem is when some site has unusual password requirements that SuperGenPass can't support. Then I must make up and remember a password for that site. :(

http://supergenpass.com/

[ Parent | on HN ]
Re:Simplified Sign-Up and Log-In Flows by decode on Wednesday February 15, 2012 @10:47AM (#3594644)
> The problem is when some site has unusual password requirements that SuperGenPass can't support. Then I must make up and remember a password for that site. :(

PasswordMaker is similar to SuperGenPass, but you can create exceptions to your default password scheme on a site-by-site basis. So, you can use lower complexity and shorter passwords for sites that have bad password policies, but still use better passwords for those that support them.

http://passwordmaker.org/

[ Parent | on HN ]
Re:Simplified Sign-Up and Log-In Flows by cpeterso on Wednesday February 15, 2012 @01:17PM (#3595371)
A serious deficiency in PasswordMaker is that, by default, it ignores subdomains, so bbc.co.uk and evil.co.uk would share the same password. But if you enable the subdomain option, then www.bbc.co.uk and www2.bbc.co.uk then have different passwords.
[ Parent | on HN ]
Re:Simplified Sign-Up and Log-In Flows by decode on Wednesday February 15, 2012 @04:47PM (#3596244)
I'm using the Firefox add-on version 1.7.8, with the default URL Components settings (subdomains not enabled), and it uses "bbc.co.uk" as the domain for "www.bbc.co.uk" and "evil.co.uk" as the domain for "evil.co.uk", so the problem you described doesn't exist.

Maybe this was a problem in an earlier version and it's been fixed?

[ Parent | on HN ]
Re:Simplified Sign-Up and Log-In Flows by cpeterso on Wednesday February 15, 2012 @08:13PM (#3596958)
I'll have to double-check. The problem is still reproducible on the (albeit limited) PasswordMaker online version:

http://passwordmaker.org/passwordmaker.html

[ Parent | on HN ]