Superpass Password Hasher

Superpass Password Hasher.

This site has a rather novel approach to dealing with passwords. I see this a lot in both my personal and professional life, especially when people lose their computers. The question looms ‘Did you… ?” and usually the answers aren’t very good at least from a security standpoint.

One of the biggest things that people can-and-should do is keep individual passwords for every single site they access. Most people could approach this via tools like my beloved 1Password but this may be another approach that might also work. It uses an encryption staple called a hash to generate a multi-character password based on some simple password, a salt (which is used to increase the randomness that is added to the encryption routine) and the domain you are working with. It’s quite elegant in that it offsets the need to store individual passwords because it, supposedly, relies on stable domain names to provide password reproducibility. Each time you enter your simple password, and the domain name hasn’t changed, you should get the same hash over and over again. I still think that 1Password is still the best choice for everyone, but this might be a good starting place especially if cash is tight and you can’t swing a 1Password license.

UPDATE: After trying this out I discovered that it only really works well on plain sites like Google.com. If you go to any other sites, like Apple or nytimes.com the code breaks down on Safari. I couldn’t get it to even work on Firefox 13 on the Mac, so perhaps this isn’t as robust as I had hoped. The idea is still good, however. For what it’s worth.

1Password Bug

I ran into this little nasty earlier today. First to set the scene:

  • Mac OSX 10.6.6
  • 1Password Version 3.5.3 (build 30812)

I got an email from Trapster.com informing me that my account may have been compromised. Since I started using 1Password I’ve been making unique 16-character passwords for each individual site, so if a hacker gets my password for one site, he may own that, but nothing else. So I opened up 1Password and my highlight was on another entry related to another item. I went to the search field, typed in “trap” and found the entry for Trapster. I edited it, clicked on the password generator and made a new 16 character password. I clicked the “copy” button in the Password Generator dialog box and 1Password decided to replace the password for the previous highlighted item with the generated password that I meant to go into Trapsters entry. I did this three times just to make sure I wasn’t losing my marbles.

The way around this is to not use the search feature at all. If you browse and highlight the Trapster entry and put in a new password that way, everything is fine.

I just thought I would blog about this to help anyone who might have run into this bug on their own, it isn’t your mind, it’s the program. I’ve forwarded the bug report to the people who write 1Password, we’ll see what response we get.