We all know how we should treat passwords. Use a mix of upper and lowercase letters, special chars and numbers. Choose longer passer passwords rather than short ones. Don't use the same password everywhere.
Well, you know that. I know that. But still, I was using two or three very insecure passwords on various websites again and again. Just because it's so much easier
. Until a few days ago.
That was when I discovered Password Hasher.
Password Hasher is a Firefox extension, helping you to make your passwords more secure.
The idea is simple: You continue to use your ridiculous simple password. But the extension creates a much more secure password from your silly password and the domain name of the login page. This secure password then is used to register and login at the page. This solves multiple problems:
Usage is simple. Just install it and whenever there is a password field to fill, open Password Hasher by one of the following methods:
Ctrl+;# button right next to the fieldIn the dialog enter your (silly) master password and click OK. Password Hasher will fill the secure password into the field and you can login.
But what when you need to login and don't have your own Firefox? Just use the JavaScript online tool at the author's website to create the secure password.
Posted on Tuesday September the 11th, 2007 (8 months ago).
This is the personal web site of Andreas Gohr
- human being, blogger and web geek from Berlin, Germany.
This page was last updated at
2007/09/11 23:25.
Imprint/Impressum
Tagged at del.icio.us:
No tags, yet. Why don't you bookmark it?
Most popular:
Elsewhere:
Recent readers:
If someone knows your using this hash function (because you wrote it on your blog), and they can guess the tag of a site (which is easy), your master still needs to be strong for him not to be able to brute-force this. I would certainly not use the silly password.
Perhaps this does help though, to be able to use the same strong master for a whole bunch of sites. If one site is compromised, your master is not compromised, i.e. calculating the inverse of the hash function is not feasible.