Password.ly
Security and privacy
password generator
SHOW HN2013
16points
54comments
#1,085of 1,739 in 2013
Top 63%of 2013 by points
How HN took it
RoastedHalf or more of the comments are critical
3 positive, 10 neutral or asking, 1 mixed, 18 critical, out of 32 comments about the project. Thread score -0.49.
Privacy: 0 for, 10 againstIdea: 1 for, 6 againstExecution: 0 for, 2 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Command line client works offline and sends nothing to the server
From 2 comments
I don't know a lick of Python, so I can't check properly, but does the CLI client[1] work entirely offline, or does it also send the password to the server for processing? I…
koralatov on HNNo, it doesn't. There is a 'pw sync' command which does send your password to the server (in order to confirm your access while updating saved comments/etc) but that is all.
qixxiq on HN
Objections
Entering a master password on a website is unsafe; the server could capture it
From 3 comments
It is not safe to enter your master password on a random website like password.ly. The risk is simply too high that it gets hacked someday and your master password will fall.…
tinco on HNHave a look at your competition such as; http://supergenpass.com/ Your system is creating the passwords server side and so taking the user's "master" password in. Where as…
DomBlack on HNThat's something I didn't like about it either -- my tin-foil hat clamped on a little tighter when I realised that your entry is fed into the server, mangled, then your new…
koralatov on HN
Generated passwords have too little entropy (about 61.7 bits)
From 1 comment
The passwords generated by this do not have enough entropy. The code that does the generation is: ``` def generatePassword(password, site): letters = 'abcdefghijklmnopqrstuvwxyz'…
jgrahamc on HN
Changing or revoking a site password is hard because passwords cannot be changed independently
From 3 comments
That is also a significant weakness, as revoking or changing passwords becomes very difficult.
zokier on HNGood one if you'd never change your password. Say I generated a password for my HSBC account with this. Later, if they ask me to change the password, I'm out of options because…
james-singh on HNI feel like this is no different than passwordchart.com but is a bit less configurable. I use 1password myself after using passwordchart for a while. Ever thought about how to…
dpham on HN
A single master password compromise exposes every password
From 3 comments
It is not safe to enter your master password on a random website like password.ly. The risk is simply too high that it gets hacked someday and your master password will fall.…
tinco on HNThis merely gives the user a false sense of security. What if a hacker get hold of your master password? I rather advocate the use of different high-entropy passwords divided in…
mekwall on HNThe master password is an Achilles heal in all of these systems. Granted, it is even more of a weak point in password.ly.
city41 on HN
Requests
Browser extension instead of a website
From 2 comments
MD5 is a no go, SHA-256 would at least be better. I will look at your sorce though. Bcrypt might be too heavy in plain JS if chrome doesn't offer it as a part of its api. But I…
arnarbi on HNHey, It's really just a MVP at the moment. There are quite a few improvements planned, and definitely a browser extension if there is any interest. At the moment it is limited to…
qixxiq on HN
Support for changing passwords and migration
From 2 comments
There is a command line client too, and the entire website is open source (links at bottom.) If you're worried about not trusting anyone, then you would need to set up your own…
qixxiq on HNIf I want to change a non-master password (some random forum I use gets hacked, for example, or an admin forces a password change), how would I do that?
waitwhat on HN
Configurable length or character classes
From 2 comments
The passwords generated by this do not have enough entropy. The code that does the generation is: ``` def generatePassword(password, site): letters = 'abcdefghijklmnopqrstuvwxyz'…
jgrahamc on HNI feel like this is no different than passwordchart.com but is a bit less configurable. I use 1password myself after using passwordchart for a while. Ever thought about how to…
dpham on HN
Questions
Can the open source code be verified as what runs on the server?
From 2 comments
> and the entire website is open source (links at bottom.) How do I know the code released for review is actually the code they're running on their server? There is no way they…
smutticus on HNI understand your point, I've thought about launching a site like this too, but the single host problem is just too big of a flaw. It has nothing to do with trusting anyone, if a…
tinco on HN
How to change a site password when the site forces a change?
From 2 comments
If I want to change a non-master password (some random forum I use gets hacked, for example, or an admin forces a password change), how would I do that?
waitwhat on HNhave to change the name of the website, there are only 2 inputs
amalag on HN
Alternatives named
SuperGenPass
From 1 comment
Have a look at your competition such as; http://supergenpass.com/ Your system is creating the passwords server side and so taking the user's "master" password in. Where as…
DomBlack on HN
KeePass
From 1 comment
http://keepass.info/
agersant on HN
1Password
From 2 comments
The site seems to suggest it will only generate passwords in the moment. But the text of the site mentions you guys saving them, and your comment mentions a command line tool.…
city41 on HNWhat do you guys think about the security of 1password? I've been using it for a while and now have a unique password for every site, as long as the site will allow. The chrome…
jameswyse on HN
Vault
From 1 comment
Vault – https://getvau.lt/ – is basically the same idea, taken much further: it lets you control the character classes used in the generated password, and the command-line…
wjt on HN
PasswordMaker Pro
From 1 comment
Not sure, why this hasn't been mentioned: https://chrome.google.com/webstore/detail/passwordmaker-pro/ocjkdaaapapjpmipmhiadedofjiokogj It is a port of Password maker pro for…
minhajuddin on HN