Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

To be honest, that looks like it has a some drawbacks when used with different domains that use the same authentication backend.

Think Google's different domains (google.com, google.co.uk, google.nl, gmail.com etc.) The demo gives a different hashed password whenever the TLD differs. And seeing that Google by default redirects you to the homepage of whatever country you're in at the moment, you might end up getting burned by the extension when travelling.



The problem of sharing passwords across domains is one of the things that prompted me to write the password-generating service Cryptasia [1].

In short, Cryptasia uses a Google Spreadsheet entirely owned & controlled by each user as a 3rd party data store. Each row contains the friendly name of the site, the login URL, the password generation key, a list of allowed characters, which characters are required, and the length of the password to create. By using the same generator key and character sets, one can have the same password for multiple websites. The password can also be changed for a website without having to change your master passphrase, since just changing the generator key (say, adding a "1" afterward) completely changes the created password.

I know it's not as easy to use as a browser extension, but when I visited Europe it was nice to be able to hop on any computer in one of the hotels and check my email.

I can throw this on Github if anyone's interested (the source-code is all in unobscured JS, too).

[1] crypt.asia or http://www.cryptasia.com


> you might end up getting burned by the extension when travelling.

Good point. This could happen. I'm assuming by "burned" you mean "unable to login". If so, you can always type in your home country's domain into the webapp version and get the correct hashed password. I agree this isn't ideal. Just saying that there's a plan B.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: