arantius.com

Password Maker Bookmarklet

2004-10-31 01:14 - Bookmarklets

Yes, they're everywhere, websites with passwords. Sometimes, they are websites you give your credit card information to, sometimes they're just discusson boards, or a million other things. But you have to use a password for every one! I bet you use the same password for every one! I know I usually do. I keep 3 passwords. The really simple one I give away to really untrustable site, the middle one I give to most places, and the big complex one I save for the places that are more sensitive.

Of course, that still leaves me somewhat vulnerable. It wouldn't be hard for someone that took my password from one of the many places that share it to log in as me at the rest of them. It's just not safe! But what can we do, I can't possibly remember a different password for every site! Well, that's where the magic of the computer comes in!

There's an amazing little tool that's been around a long time called a bookmarklet. Yeah, they're old enough to be from the Netscape era, and thus called bookmarklets, though some people use the term Favelet (eeew, IE). There's a truly great set of them over at Jesse's Bookmarklet Site. I especially love the "Up" bookmarklet, the first in the Miscellaneous category. Very useful, one of the few things I missed (from the google bar) in IE that's not in Firefox. I also found one day a "password generator bookmarklet." A truly genius idea, a bookmarklet that takes the current site's domain name, your master password, and a bit of cryptography magic to turn it into a unique series of letters and numbers. Or, a strong password!

I started using it, and I was enjoying it. I felt safer, and I lost no convenience. But before long, I noticed problems. He says right on his site that it's not compatible with IE. I hate and I don't use IE, but some people have to. He has a link to a site with a workaround, which is up now but wasn't available when I first found it. It's also a bit hacky forcing you to save the javascript as a file on your computer. It also, though running the whole MD5 script, chops off the result at 8 characters. Who knows how good MD5 really is when you only use a quarter of the output.

But worst of all is the way it relies on domain name. I very nearly lost my ~6 year old well established ebay account thanks to it. Ebay of course uses multiple domain names: www.ebay.com, signin.ebay.com, scgi.ebay.com and more. It would gerenate a different password for each one. Or, as I expereinced, definetly a different one for where you change your password, and where you sign in.

So I thought about it for quite a while, then I worked on it for quite a while, and bam! I came up with a password maker bookmarklet inspired by the one linked above, but with none of those restrictions. It hit me when I stumbled upon a web page describing some hash functions. I had been looking into it a bit, but could only find very complicated hashes like MD5, used in the above linked script. The MD5 algorithm takes about 9k of code in javascript. I was really hoping to fit into 508 bytes, the maximum IE (6 win) can use. Well that page there showed three very simple hash functions.

Simple isn't good when it comes to a password. But, in this instance, it's not truly bad. The intent of this is really just to protect you a bit, by making sure that you don't use the same password for each site. It's not a "strong" cryptographic hash like MD5 or SHA. It's a rather weak one to fit in 508 bytes in javascript. But it does it's job. You should consider using other, strong, passwords for important logins like banks or e-commerce sites.

Enough blabbering, here's some code! First, the bookmarklet: MyPass. Drag that onto your links toolbar, your bookmarks menu, your favorites menu. Right click and choose add bookmark, add favorite, whatever. Like any bookmarklet. Then, just click it and enter your "master password." The master password, which you can safely keep the same for all sites, is taken along with the top level domain name (for this site, it would be arantius.com) and hashed to give you an 8 character letters and numbers password. It is filled into any password-type form field, or text-type form field named password.

Here's a little demonstration. You can type into the small form below your master password and a domain name, and get out the password for any site. This really runs in your browser, I never get your passwords =) Save it to your hard drive and unplug your internet connection if you're paranoid. Plus, you can read all the source code right there in View Source.

I hope you enjoy this! You can play with the form above and see that each different domain name makes a very different password, even with the same master password.