5 ms·

Show HN: PW - Simple, secure & cross-platform password generator

1 points by simontabor 13y ago

danpalmer 13y ago
Looks interesting, but I might be missing something here, what actually is it? Why does it need the service and a password, isn't it generating a password? And how is it cross-platform, it looks like it's web based?
- simontabor 13y ago
  Probably didn't make it clear enough, it's repeatable so you'd use Twitter as the service and whatever password you usually use (master password), it'd come back with a hash and you use that as your Twitter password. Whenever you need your Twitter password, you repeat the process. https://github.com/simontabor/pw https://github.com/simontabor/pw - it's got node-webkit so there's a mac app in that repo and should also work on Windows + Linux nicely (this is simply to take it out of the browser where it's easy to lose tabs and put it in a clean, small window)
  - danpalmer 13y ago
    It's a nice touch to provide a local application to run as there is no way people should be doing this in the browser. You might want to remove the tracking from the local app though, even if it is for analytics purposes, I don't want something that deals with passwords like this to be phoning home.
    - simontabor 13y ago
      I may do, it's not too difficult for people who care about it to just take it out - I'd actually rather people take the code, remove tracking if they'd like, edit colours/whatever and make it their own. It's more the concept that I care about (never ever send your main password over the wire)
ugexe 13y ago
Making all the passwords the same length makes this essentially pointless.
- simontabor 13y ago
  It's a repeatable SHA1 hash, what more do you want?
  - ugexe 13y ago
    I don't want everyone to know the length of my password that's for sure.
    - danpalmer 13y ago
      To be fair, although I really dislike the idea of fixed length passwords, with this many characters it's not too bad. A full search of the password space that this outputs would take ~10^50 years at the moment, on high end hardware, and shouldn't be susceptible to attacks on patterns, assuming SHA is working properly. One thing I would say is that with something like this you might as well just remember a really long password and tag on the name of the service at the beginning, that will give you (arguably) more security. Something like hackernewsFe26476e75256504234fC7CbBcE05aEd704b94A2.
      - simontabor 13y ago
        That's a decent idea, appending/prepending the service name to the hash would probably help.
    - simontabor 13y ago
      Sounds like you've misunderstood the purpose of this. I usually just use a single password across most services, so they all know your password, even if you trust them not to store it in plain text. It's infinitely more secure to use something like PW, never entering your main/master password into any other services and then have a generated hash that really means nothing to anyone (can't be decoded or anything stupid). The length factor here makes very little difference, and only you need to know that you use 40 character password (yes, 40, which I bet is longer and more secure than your current password(s))
deleted 13y ago
[deleted]
danpalmer 13y ago
> echo "service-password" | openssl sha This is a quick alternative that should work on Mac OS and Linux, and Windows when openssl has been installed in a similar way.

1 points by simontabor 13y ago

Looks interesting, but I might be missing something here, what actually is it? Why does it need the service and a password, isn't it generating a password? And how is it cross-platform, it looks like it's web based?

simontabor 13y ago
Probably didn't make it clear enough, it's repeatable so you'd use Twitter as the service and whatever password you usually use (master password), it'd come back with a hash and you use that as your Twitter password. Whenever you need your Twitter password, you repeat the process. https://github.com/simontabor/pw https://github.com/simontabor/pw - it's got node-webkit so there's a mac app in that repo and should also work on Windows + Linux nicely (this is simply to take it out of the browser where it's easy to lose tabs and put it in a clean, small window)
- danpalmer 13y ago
  It's a nice touch to provide a local application to run as there is no way people should be doing this in the browser. You might want to remove the tracking from the local app though, even if it is for analytics purposes, I don't want something that deals with passwords like this to be phoning home.
  - simontabor 13y ago
    I may do, it's not too difficult for people who care about it to just take it out - I'd actually rather people take the code, remove tracking if they'd like, edit colours/whatever and make it their own. It's more the concept that I care about (never ever send your main password over the wire)

ugexe 13y ago

Making all the passwords the same length makes this essentially pointless.

simontabor 13y ago
It's a repeatable SHA1 hash, what more do you want?
- ugexe 13y ago
  I don't want everyone to know the length of my password that's for sure.
  - danpalmer 13y ago
    To be fair, although I really dislike the idea of fixed length passwords, with this many characters it's not too bad. A full search of the password space that this outputs would take ~10^50 years at the moment, on high end hardware, and shouldn't be susceptible to attacks on patterns, assuming SHA is working properly. One thing I would say is that with something like this you might as well just remember a really long password and tag on the name of the service at the beginning, that will give you (arguably) more security. Something like hackernewsFe26476e75256504234fC7CbBcE05aEd704b94A2.
    - simontabor 13y ago
      That's a decent idea, appending/prepending the service name to the hash would probably help.
  - simontabor 13y ago
    Sounds like you've misunderstood the purpose of this. I usually just use a single password across most services, so they all know your password, even if you trust them not to store it in plain text. It's infinitely more secure to use something like PW, never entering your main/master password into any other services and then have a generated hash that really means nothing to anyone (can't be decoded or anything stupid). The length factor here makes very little difference, and only you need to know that you use 40 character password (yes, 40, which I bet is longer and more secure than your current password(s))

deleted 13y ago

[deleted]

danpalmer 13y ago

> echo "service-password" | openssl sha This is a quick alternative that should work on Mac OS and Linux, and Windows when openssl has been installed in a similar way.