[{"data":1,"prerenderedAt":390},["ShallowReactive",2],{"project-5026103":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":43,"post_text":45,"what":46,"said":88,"maker_in_thread":219,"shape":226,"grid":228,"attempts":352,"same_week":353,"maker_shows":44,"maker_hidden":382,"reader_version":383,"card":384},"5026103","Password.ly","Per site password generator from a master password","title","Show HN: Password.ly - Per site password generator from a master password","https:\u002F\u002Fpassword.ly","password.ly","qixxiq",1357652220,2013,16,54,1085,1739,63,"shown","security_privacy","password generator","web_app",[21,24,25,26],"master password","per site password","password manager","roasted",-0.486,{"positive":30,"neutral":31,"mixed":32,"critical":33},3,10,1,18,32,{"privacy":36,"execution":38,"idea":40,"docs":42},{"positive":37,"critical":31},0,{"positive":37,"critical":39},2,{"positive":32,"critical":41},6,{"positive":37,"critical":37},[32,37,30,32,37,32,37,37,32,37,30,30,37,37,32,32,32,30,32,37,37,37,32,32,37,30,37,44,32,32,32,44,37,44,37,37,37,37,32,32],5,null,{"problem":47,"audience":57,"pricing":45,"motivation":61,"time_to_build":45,"stack":65,"openness":85,"stage":86,"team_size":87},{"value":48,"source":49,"evidence":50},"Users reuse passwords or must remember many; it derives a unique password per site from a master password","maker",[51,54],{"id":52,"by":11,"text":53},"5026231","There is a command line client too, and the entire website is open source (links at bottom.) If you're worried about not trusting anyone, then you would need to set up your own…",{"id":55,"by":11,"text":56},"5026161","The biggest difference between password.ly and most other tools (including keepass), is that each password on password.ly is generated from your master password. There is no…",{"value":58,"source":49,"evidence":59},"People who type a master password on many websites and want one password to remember",[60],{"id":52,"by":11,"text":53},{"value":62,"source":49,"evidence":63},"Avoid typing many passwords; only the master password needs typing",[64],{"id":52,"by":11,"text":53},[66,78],{"value":67,"source":68,"evidence":69},"Python","commenter",[70,74],{"id":71,"by":72,"text":73},"5026228","jgrahamc","The passwords generated by this do not have enough entropy. The code that does the generation is: ``` def generatePassword(password, site): letters = 'abcdefghijklmnopqrstuvwxyz'…",{"id":75,"by":76,"text":77},"5026223","koralatov","I don't know a lick of Python, so I can't check properly, but does the CLI client[1] work entirely offline, or does it also send the password to the server for processing? I…",{"value":79,"source":68,"evidence":80},"JavaScript",[81],{"id":82,"by":83,"text":84},"5026186","DomBlack","Have a look at your competition such as; http:\u002F\u002Fsupergenpass.com\u002F Your system is creating the passwords server side and so taking the user's \"master\" password in. Where as…","open_source","launched","unknown",{"praise":89,"objections":97,"requests":140,"questions":164,"alternatives":183},[90],{"value":91,"source":49,"evidence":92},"Command line client works offline and sends nothing to the server",[93,94],{"id":75,"by":76,"text":77},{"id":95,"by":11,"text":96},"5026336","No, it doesn't. There is a 'pw sync' command which does send your password to the server (in order to confirm your access while updating saved comments\u002Fetc) but that is all.",[98,109,113,128],{"value":99,"source":68,"evidence":100},"Entering a master password on a website is unsafe; the server could capture it",[101,105,106],{"id":102,"by":103,"text":104},"5026211","tinco","It is not safe to enter your master password on a random website like password.ly. The risk is simply too high that it gets hacked someday and your master password will fall.…",{"id":82,"by":83,"text":84},{"id":107,"by":76,"text":108},"5026215","That's something I didn't like about it either -- my tin-foil hat clamped on a little tighter when I realised that your entry is fed into the server, mangled, then your new…",{"value":110,"source":68,"evidence":111},"Generated passwords have too little entropy (about 61.7 bits)",[112],{"id":71,"by":72,"text":73},{"value":114,"source":68,"evidence":115},"Changing or revoking a site password is hard because passwords cannot be changed independently",[116,120,124],{"id":117,"by":118,"text":119},"5026201","zokier","That is also a significant weakness, as revoking or changing passwords becomes very difficult.",{"id":121,"by":122,"text":123},"5026233","james-singh","Good one if you'd never change your password. Say I generated a password for my HSBC account with this. Later, if they ask me to change the password, I'm out of options because…",{"id":125,"by":126,"text":127},"5026329","dpham","I feel like this is no different than passwordchart.com but is a bit less configurable. I use 1password myself after using passwordchart for a while. Ever thought about how to…",{"value":129,"source":68,"evidence":130},"A single master password compromise exposes every password",[131,132,136],{"id":102,"by":103,"text":104},{"id":133,"by":134,"text":135},"5026187","mekwall","This merely gives the user a false sense of security. What if a hacker get hold of your master password? I rather advocate the use of different high-entropy passwords divided in…",{"id":137,"by":138,"text":139},"5026198","city41","The master password is an Achilles heal in all of these systems. Granted, it is even more of a weak point in password.ly.",[141,151,159],{"value":142,"source":68,"evidence":143},"Browser extension instead of a website",[144,148],{"id":145,"by":146,"text":147},"5026354","arnarbi","MD5 is a no go, SHA-256 would at least be better. I will look at your sorce though. Bcrypt might be too heavy in plain JS if chrome doesn't offer it as a part of its api. But I…",{"id":149,"by":11,"text":150},"5026202","Hey, It's really just a MVP at the moment. There are quite a few improvements planned, and definitely a browser extension if there is any interest. At the moment it is limited to…",{"value":152,"source":49,"evidence":153},"Support for changing passwords and migration",[154,155],{"id":52,"by":11,"text":53},{"id":156,"by":157,"text":158},"5026249","waitwhat","If I want to change a non-master password (some random forum I use gets hacked, for example, or an admin forces a password change), how would I do that?",{"value":160,"source":68,"evidence":161},"Configurable length or character classes",[162,163],{"id":71,"by":72,"text":73},{"id":125,"by":126,"text":127},[165,175],{"value":166,"source":68,"evidence":167},"Can the open source code be verified as what runs on the server?",[168,172],{"id":169,"by":170,"text":171},"5026245","smutticus","> and the entire website is open source (links at bottom.) How do I know the code released for review is actually the code they're running on their server? There is no way they…",{"id":173,"by":103,"text":174},"5026247","I understand your point, I've thought about launching a site like this too, but the single host problem is just too big of a flaw. It has nothing to do with trusting anyone, if a…",{"value":176,"source":68,"evidence":177},"How to change a site password when the site forces a change?",[178,179],{"id":156,"by":157,"text":158},{"id":180,"by":181,"text":182},"5026346","amalag","have to change the name of the website, there are only 2 inputs",[184,188,195,205,212],{"value":185,"source":68,"evidence":186},"SuperGenPass",[187],{"id":82,"by":83,"text":84},{"value":189,"source":68,"evidence":190},"KeePass",[191],{"id":192,"by":193,"text":194},"5026150","agersant","http:\u002F\u002Fkeepass.info\u002F",{"value":196,"source":68,"evidence":197},"1Password",[198,201],{"id":199,"by":138,"text":200},"5026189","The site seems to suggest it will only generate passwords in the moment. But the text of the site mentions you guys saving them, and your comment mentions a command line tool.…",{"id":202,"by":203,"text":204},"5026253","jameswyse","What do you guys think about the security of 1password? I've been using it for a while and now have a unique password for every site, as long as the site will allow. The chrome…",{"value":206,"source":68,"evidence":207},"Vault",[208],{"id":209,"by":210,"text":211},"5026244","wjt","Vault – https:\u002F\u002Fgetvau.lt\u002F – is basically the same idea, taken much further: it lets you control the character classes used in the generated password, and the command-line…",{"value":213,"source":68,"evidence":214},"PasswordMaker Pro",[215],{"id":216,"by":217,"text":218},"5026358","minhajuddin","Not sure, why this hasn't been mentioned: https:\u002F\u002Fchrome.google.com\u002Fwebstore\u002Fdetail\u002Fpasswordmaker-pro\u002Focjkdaaapapjpmipmhiadedofjiokogj It is a port of Password maker pro for…",{"comments":44,"answered":30,"key":220},[221,222,225],{"id":52,"text":53},{"id":223,"text":224},"5026246","I'm curious to know where the 80 bit number comes from? The 61 bits seems like a crazy large number to try and brute-force, but perhaps there are other issues besides brute force…",{"id":55,"text":56},{"commenters":34,"max_depth":227,"maker_replies":44,"first_comment_mins":33,"lifespan_hours":39},4,[229,231,233,235,238,239,243,245,247,250,252,255,256,258,260,264,266,270,272,274,275,276,279,281,282,284,285,288,291,292,294,297,300,302,307,310,311,314,317,318,319,321,324,326,327,329,333,336,338,340,342,345,347,350],[102,37,32,230,103,37],"project\u002Fcritical\u002Fprivacy",[52,37,37,232,11,32],"maker\u002Fneutral\u002Fidea",[169,37,30,234,170,37],"project\u002Fneutral\u002Fprivacy",[236,37,30,234,237,37],"5026345","jrogers65",[173,37,32,230,103,37],[240,32,37,241,242,37],"5026268","other\u002Fneutral\u002Fidea","shabda",[244,32,32,230,103,37],"5026303",[145,32,32,246,146,37],"project\u002Fcritical\u002Fexecution",[248,32,37,249,134,37],"5026368","commenter\u002Fneutral\u002Fexecution",[251,32,37,249,242,37],"5026370",[253,32,32,230,254,37],"5026379","gst",[71,39,32,230,72,37],[223,39,37,257,11,32],"maker\u002Fneutral\u002Fprivacy",[259,39,30,234,134,37],"5026269",[261,39,30,262,263,37],"5026274","maker\u002Fneutral\u002Fexecution","benologist",[265,39,30,234,134,37],"5026261",[267,39,37,268,269,37],"5026323","commenter\u002Fneutral\u002Fnone","alexkus",[271,39,37,268,72,37],"5026349",[273,39,37,268,134,37],"5026351",[82,30,32,230,83,37],[107,30,32,230,76,37],[277,227,32,230,278,37],"5026289","peterwwillis",[156,44,30,280,157,37],"project\u002Fneutral\u002Fexecution",[180,44,30,280,181,37],[283,44,32,246,157,37],"5026568",[192,41,37,241,193,37],[286,41,37,268,287,37],"5026159","FreshCode",[289,41,37,268,290,37],"5026243","jsaxton86",[55,41,37,232,11,32],[117,41,32,293,118,37],"project\u002Fcritical\u002Fidea",[295,41,32,293,296,37],"5026418","nollidge",[298,41,32,230,299,37],"5026383","mmahemoff",[301,41,37,268,296,37],"5026426",[303,304,30,305,306,37],"5026195",7,"project\u002Fmixed\u002Fprivacy","michaeltoth",[199,308,30,309,138,37],8,"project\u002Fneutral\u002Fdocs",[149,308,37,232,11,32],[312,308,44,313,138,37],"5026218","maker\u002Fpositive\u002Fnone",[202,315,37,316,203,37],9,"other\u002Fneutral\u002Fnone",[133,31,32,293,134,37],[137,31,32,230,138,37],[320,31,32,293,134,37],"5026204",[322,31,44,323,138,37],"5026232","project\u002Fpositive\u002Fidea",[75,325,30,234,76,37],11,[95,325,37,257,11,32],[328,325,44,313,76,37],"5026384",[330,331,37,316,332,37],"5026194",12,"anykey",[334,331,37,268,335,37],"5026219","de_dave",[337,331,37,268,134,37],"5026220",[216,339,37,241,217,37],13,[209,341,37,241,210,37],14,[343,341,37,316,344,37],"5026283","jwl",[125,346,32,293,126,37],15,[348,14,30,349,181,37],"5026364","project\u002Fneutral\u002Fidea",[121,351,32,293,122,37],17,[],[354,359,364,369,374,378],{"id":355,"name":356,"points":357,"category":358},"5022472","Pitchbox",233,"web_saas",{"id":360,"name":361,"points":362,"category":363},"5003672","phrase.it",225,"creative",{"id":365,"name":366,"points":367,"category":368},"5012920","gcsms",121,"dev_tools",{"id":370,"name":371,"points":372,"category":373},"5032470","FileRock",97,"infrastructure",{"id":375,"name":376,"points":377,"category":358},"5026802","Balanced Payouts",91,{"id":379,"name":380,"points":18,"category":381},"5020577","Slowpal","finance_crypto",false,"v2",{"id":385,"name":5,"line":6,"ai":382,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":386,"top":18,"kw":387,"maker":11,"domain":10,"tier":19,"attempts":37,"strip":388,"url":9,"mix":389,"praise":91,"objection":99,"sub":21},5026103,-0.49,[21,24,25,26],"1031010010330011131000110305111505000011",[30,31,32,33],1793990889680]