Since password managers are big and complicated and I currently am pretty bored since I am sitting in a car for a few hours, here is a simple algorithm to generate resource-specific, unique passwords using a master password and no password database.
As pointed out here: http://news.ycombinator.com/item?id=4374888 this method is broken.
Simply paste the following line into a shell, type your master password (correctly, please, for there are no safeguards in place to protect you from typos) and press [enter] [ctrl-d] and you will be provided with a secure password specific for www.example.com.
(sha512sum ~/.salt -<<<www.example.com;sha512sum -)|cut -d\ -f1|sha512sum|cut -c-32Please not that this line will produce the same password every time you invoke it, provided that nobody messed around in your .salt file and you still remember your master password.
The salt can be pretty much any immutable file (i.e. .jpg and other files which tend to be modified by programs because of stored metadata are a really bad idea), as long as it is more or less unique. I generated mine with the following command line:
(dmesg;env;head -c16 /dev/random)|sha512sum>>~/.salt; chmod 400 ~/.saltUnder certain circumstances, this line may take a few seconds while /dev/random gathers entropy.
The password generate takes hex sha512-hashes of your salt file, your master password and the resource name you wish to generate a password for (i.e. e.g. a domain name), concatenates them one per line, hashes the result and takes the first 32 characters of the result's hex value. The resulting value is dependant on each of the three variables and no one of the variables can be computed from it (these are properties of cryptographic hashes as sha-512 is one). Obviously, the process could be improved if you would find a portable way to encode the resulting hash in a charset consisting of more than 16 digits, for then the resulting password could be made significantly shorter than 32 characters without loosing any entropy compared to now.
The salt file generation takes your dmesg (system-specific), your env (user specific) and a few random bytes (random), concatenates and hashes them, and puts the hash's hex string into the salt file.
Just a clarification, this produces a 32-character password? Most sites don't accept passwords that long, although 16-char ones are accepted. I like the idea of the length of the pass vs the complexity of its characters. Also, if you're on OSX(I'm pretty sure there's a linux port of this) you can just pipe everything to pbcopy so you automatically have it on your clipboard. Best way would be to create a one-two char alias in your shell, something like
opso you can just fire your terminal (i usectrl+~), typeop example.com(or you can even add aliases to sites: fb for facebook etc) then boom, you got your password on your clipboard. 4 keystrokes + the site name/alias vs your 8-16 char password? I'd take this any day :)Great idea!