Re:Hack of Cupid Media dating website exposes 42 million pla...
by thatthatis on Wednesday November 20, 2013 @07:42AM
(#6767644)
That doesn't quite work in the unfortunately common case of user password re-use. If your hash is constant and stored in plain text somewhere and that place gets hacked -- then your password at every site is compromised.
[ Parent
| on HN ]
Re:Hack of Cupid Media dating website exposes 42 million pla...
by Jach on Wednesday November 20, 2013 @09:24AM
(#6768090)
If you use an actual bash script instead of a one-liner, and you can do things like 'silently' read in the password with `read -s` in the standard *nix convention, even read it twice to avoid mistyping your master key and temporarily locking yourself out of an account you just created.
Re:Hack of Cupid Media dating website exposes 42 million pla...
by raverbashing on Wednesday November 20, 2013 @12:05PM
(#6769245)
Here's a tentative crude solution
you can pass a "salt" as the first argument as well (it will merely be concatenated with the password)
Re:Hack of Cupid Media dating website exposes 42 million pla...
by Jach on Wednesday November 20, 2013 @12:39PM
(#6769508)
You should quote your vars in the if check, otherwise it doesn't handle spaces very well. (And really the master key should be a master passphrase.)
A few years ago I whipped this up: http://www.thejach.com/public/pw2 (I don't recommend other people use it but it works for me.) I type in something along the lines of "my secret passphrase ycombinator.com". It doesn't do hash iteration and uses the hash as a seed to Python's RNG which I use to get random bytes and then have a password character-space of any printable character -- it also outputs an alpha-numeric version along with different string sizes to handle those dumb sites that put restrictions on your password.
Re:Hack of Cupid Media dating website exposes 42 million pla...
by raverbashing on Wednesday November 20, 2013 @08:24AM
(#6767793)
Yes, you need to add a salt, it can be the URL (and something else added)