Hacker News new | past | comments | ask | show | jobs | submit login

My reccommendation is to use "nonce + domain name" for all of the sites you need passwords for and then hash it.

  $ echo password@$(echo nonce+hackernews.com|md5sum|tr [[:lower:]] [[:upper:]])

  password@FB85C2F638706D4BE4192391387C2879
The above format gives you lower, upper, digit and special character.



I wish I could do something like this all the time, but there are always some sites that force you to put symbols in your password, or to use both lower and upper case, or to be between 6 and 8 characters long, or whatever weird requirement they thought would be a good idea.

And since I can't (and don't want to) remember which sites enforce which restriction, I end up having to resort to writing my passwords in a text file.


https://www.pwdhash.com is a browser extension that does exactly this automatically.

Oh and hash functions won't output symbols or banned chars. They output numbers and you can choose to represent those numbers in whatever mad way that you want, typically as hex, ie. letters and digits.

The length might be a problem but there's nothing to stop you truncating the hash.


Be careful when using PwdHash.

The used hashing mechanism is quite weak. If you don't have a long high-entropy master password, it should be feasible for a site-owner to brute-force your master-password based on the site-specific password.


Yes, but then I have to remember for which sites did I truncate the hash, for which I converted the hash to hexadecimal, etc.


Le mieux est l'ennemi du bien. -- The perfect is the enemy of the good. (Volataire)

What product is going to solve every corner case you can throw at it?

FWIW my example string contained symbols, upper, lower and digits:

password@FB85C2F638706D4BE4192391387C2879




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: