My page isn’t the home for PwdHash, as I noted in my previous post I merely created a better web interface than the one they offered.

I don’t intend to be dismissive, but it’s hard to engage in a “debate” when half of my responses are simply “go read what I wrote”.

Frankly, from your usage description I can’t see how using PwdHash would be a burden to you. Instead of replicating your passwords on every machine you’d just install this extension (which clearly you can do, since you’ve installed the Google extension).

Anyways, personally I’m waiting for a better solution to come around. you’ve documented well the disadvantages of pwdhash in this post and the advantages still don’t out way them–for me–.

Just another time to look towards what’s ahead, like openid.

Here the post is: http://www.rangwan.c[...]lar-firefox/

My solution doesn’t have any single points of failure except maybe someone retrieving my password db from one of my local machines and then cracking it somewhere else, which you know is highly unlikely. More unlikely then someone getting to your “password page”.

I refer to the “password page” from your previous post but I’m still unclear as how that page works. And I’m assuming that is the only way for you to get passwords from a new previously unused computers. Hmmm…hope you reset the browser cache.

So in defense I don’t have a “single point” of failure. Like everyone should I have all of my computers locked down with a system password and never stays unlocked while I’m away. I believe this is the single point of failure, if you’re worried about someone using an account of yours (locally) then you should be more worried about them getting into your apps, documents or stealing the damn computer and cracking somewhere else.

As for the trust Google thing. I have to; I use Gmail. They already know more about me then my mom or wife.

To detail what I do:
Multi-Tier
Modifiers
System password which is extremely hard to guess and locks down the computer on a 5 min. screensaver
Sync by GBS and a “Master password”

And when I’m away from any of my systems I can easily remember my passwords. Something you can never do with a hash. And I’m more worried of someone getting my master list through keylogging, screenshots or other malicious ways then them using the same method to get into one of my tiers.

I’m ranting a little and if you don’t mind I’ll continue.

We live in a world that we need to be paranoid and aware. If you limit yourself to just making your passwords long and impossible to crack then you’re allowing someone to locally break into your machine or someone tampering with your or anyother machine with something that logs your keys and/or hashes.

There are a lot of points of failure in the processes we use but you cannot deny the more common singe point of failure is trusting an untrusted machine. Which reminds me of a friends insight.

No, it’s not as good as a completely unique password. But it’s not bad enough, for me, to warrant changing all of my passwords everywhere.

My primary password aggravation is sites with ridiculous password requirements that force me to deviate from my pattern. “Your password must contain between 6 and 8 characters” or (this was just today at source forge) “Your password can contain only numbers and letters”. How ridiculous and insecure is that?

I have looked at several password hash programs, but I’m not sure how much I like cutting and pasting the hashed password. I would like a tool that would create the password and automatically fill it in on the form.

Um, that’s exactly what PwsHash does… you only need the web interface if you aren’t using a browser with the extension installed.

I have looked at several password hash programs, but I’m not sure how much I like cutting and pasting the hashed password. I would like a tool that would create the password and automatically fill it in on the form. Then if it supported entry of the master password once/session it would be very convenient, almost as easy as storing the password in the browser but much more secure. But none of the programs that I looked at seem to have this capability.

I think ultimately you need to use tiers. Having separate passwords for real critical things (bank accounts, etc.) and shared ones for things you don’t really care about.